Wegweiser Employers · Duties for small businesses and households Deutsch

🔒 Data protection and works council

Employee data may only be processed if necessary. Works councils exist from five permanent employees entitled to vote; data protection officers from 20 persons.

data protection employee data protection BDSG works council data protection officer co-determination personnel file

In brief

You record names, addresses, bank details, sick notifications. These are personal data. You may only use them if necessary for the employment relationship, for example for application, performance or termination.

Handle the data sparingly. Keep personnel documents locked or access-protected.

A data protection officer is required if as a rule at least 20 persons are permanently engaged in automated data processing.

A works council can be elected if the business as a rule has at least five permanent employees entitled to vote, of whom three are eligible for election. You may not obstruct the election.

Step by step

  1. Sort your dataWhat data do you have? What do you need it for? Delete what is superfluous.
  2. Protect accessKeep personnel files and payroll data accessible only to authorised persons.
  3. Check the thresholdsCount your employees for the works council and the data protection officer.
  4. Take advice on video and trackingMonitoring of employees is particularly sensitive.

Deadlines

at least five employees
Works council: five permanent employees entitled to vote, of whom three eligible for election§ 1 Abs. 1 BetrVG
at least 20 persons
Duty to have a data protection officer with permanent automated processing§ 38 Abs. 1 BDSG
Watch out – common mistakes
  • § 38 Abs. 1 BDSG requires a data protection officer regardless of the number of employees also for processing that requires a data protection impact assessment.
  • Data protection rules also apply to small businesses and to the private household as employer; the General Data Protection Regulation (GDPR) was not evaluated here in its wording.
  • Works councils have co-determination rights, including on technical devices for monitoring (§ 87 Abs. 1 Nr. 6 BetrVG, mentioned in the BAG decision).
  • Retention and deletion periods for personnel documents were not evaluated.
In depth · legal basis, figures and practice – for advisers and professionals

Employee data protection (§ 26 BDSG)

§ 26 Abs. 1 Satz 1 BDSG: personal data of employees may be processed for the purposes of the employment relationship if this is necessary for the decision on establishing an employment relationship or, after it is established, for its performance or termination, or for exercising or fulfilling the rights and duties of the employees' representation arising from a law, collective agreement or works or service agreement. Further paragraphs (consent, special categories of data) and the effects of the case law of the European Court of Justice on § 26 were not evaluated.

Data protection officer (§ 38 Abs. 1 BDSG)

To be appointed if as a rule at least 20 persons are permanently engaged in the automated processing of personal data; also, regardless of the number of persons, for processing that is subject to a data protection impact assessment, or for commercial transfer or market and opinion research.

Works council (§ 1 Abs. 1 BetrVG)

"Works councils are elected in businesses with as a rule at least five permanent employees entitled to vote, of whom three are eligible for election." Whether family members count and how to deal with private households was not checked; § 5 BetrVG (definition of employee) was not retrieved.

Who is responsible
  • Data protection supervisory authority of the respective federal state
  • IHK or Chamber of Crafts
  • Lawyers specialising in employment and data protection law
Further reading
Working time recordingEmployment contract and Nachweisgesetz

Quick questions

Worum geht es bei „Data protection and works council“?
Employee data may only be processed if necessary. Works councils exist from five permanent employees entitled to vote; data protection officers from 20 persons.
Which deadlines and figures matter?
  • at least five employees: Works council: five permanent employees entitled to vote, of whom three eligible for election (§ 1 Abs. 1 BetrVG)
  • at least 20 persons: Duty to have a data protection officer with permanent automated processing (§ 38 Abs. 1 BDSG)
What should I do first?
  • Sort your data: What data do you have? What do you need it for? Delete what is superfluous.
  • Protect access: Keep personnel files and payroll data accessible only to authorised persons.
  • Check the thresholds: Count your employees for the works council and the data protection officer.
What do I need to watch out for?
  • § 38 Abs. 1 BDSG requires a data protection officer regardless of the number of employees also for processing that requires a data protection impact assessment.
  • Data protection rules also apply to small businesses and to the private household as employer; the General Data Protection Regulation (GDPR) was not evaluated here in its wording.
  • Works councils have co-determination rights, including on technical devices for monitoring (§ 87 Abs. 1 Nr. 6 BetrVG, mentioned in the BAG decision).
Evidence
  • BDSG §§ 26, 38, gesetze-im-internet.de, retrieved 20 September 2026
  • BetrVG § 1, gesetze-im-internet.de, retrieved 20 September 2026
  • Bundesarbeitsgericht, 1 ABR 22/21 (Mitbestimmung § 87 BetrVG), retrieved 20 September 2026
As of

September 2026 · Sources and method

A question about your situation that this page does not answer? Write to us or use the contact form – we will tell you which office is responsible and what to bring. Free of charge, without individual legal advice.