Confidentiality and Data Protection at Work in Germany

Several layers of rules

In Germany, confidentiality at work rests on several layers that apply side by side. Professional secrecy (Schweigepflicht) in the Criminal Code protects secrets that people entrust to certain professions. Data protection law (Datenschutz) – above all the EU General Data Protection Regulation (GDPR, in German DSGVO) and the Federal Data Protection Act (BDSG) – governs how personal data may be handled at all. In social services there is a third layer, social data protection (Sozialdatenschutz), in the Social Codes. Your employment contract and your employer’s internal rules add to this. (Which rules apply to you depends on your role, your employer and the federal state. This guide gives general orientation, not legal advice.)

Professional secrecy – § 203 of the Criminal Code

Section 203(1) StGB punishes anyone who, without authorisation (unbefugt), discloses another person’s secret – a secret from the sphere of personal life or a business secret – that was entrusted to them or became known to them in one of the listed capacities. The penalty is imprisonment of up to one year or a fine. If the person acts for payment or intends to enrich themselves or someone else or to harm someone, the penalty is higher (section 203(6)). The duty can continue after the affected person has died (section 203(5)).

The list in subsection 1 is specific. Among others it names:

• doctors, dentists, pharmacists and members of another healing profession whose practice or professional title requires state-regulated training (Nr. 1) – registered nurses (Pflegefachfrau / Pflegefachmann) are generally counted here, because using this job title requires a permit under section 1 of the Nursing Professions Act (PflBG) (this classification is general professional knowledge, not wording of section 203; ask your employer how it classifies your role);
• professional psychologists with a state-recognised university degree (Nr. 2);
• marriage, family, parenting or youth counsellors and addiction counsellors in a counselling centre recognised by a public authority or public body (Nr. 4);
• state-recognised social workers and state-recognised social education workers (staatlich anerkannte Sozialarbeiter / Sozialpädagogen) (Nr. 6).

Section 203(2) adds a second group that is relevant in the public sector: among others, public officials (Amtsträger) and persons specially obligated for the public service (für den öffentlichen Dienst besonders Verpflichtete). Whether this applies to you, for example in a youth welfare office or a municipal day-care centre, depends on your position – ask your employer.

Not every job is named in these lists. Kita educators (Erzieherinnen and Erzieher), for example, are not named in subsection 1; Nr. 6 covers only state-recognised social workers and social education workers. That does not mean that anything may be passed on: your employer, your contract, data protection law and – in social services – the Social Codes may still bind you. Never conclude from the wording alone that you are free to share information.

People who work alongside a listed professional are included as well. Under section 203(3), making a secret accessible to employed assistants (berufsmäßig tätige Gehilfen) or to persons preparing for the profession is not a “disclosure”. Disclosure to other persons who contribute to the professional work is allowed only insofar as this is necessary for using their services. Under section 203(4), a contributing person who discloses a secret without authorisation can be punished. The professional can also be punished if such another contributing person discloses a secret without authorisation and the professional had not made sure that this person was obliged to secrecy.

GDPR basics you will meet in practice

The GDPR applies to every “processing” of personal data – collecting, storing, writing down, passing on, deleting. Article 5(1) sets out the principles. Data must be processed lawfully, fairly and transparently; collected for specified purposes; limited to what is necessary (data minimisation); accurate; stored no longer than necessary; and kept secure and confidential. Under Article 5(2) the controller (Verantwortlicher) – usually your employer, not you personally – must be able to demonstrate compliance.

Processing needs a legal basis. Article 6(1) lists several: consent, a contract, a legal obligation, vital interests, a public-interest task, or legitimate interests. Consent (Einwilligung) is only one of them and not always the right one. Public authorities cannot rely on legitimate interests for their tasks (Article 6(1), second subparagraph).

Health data is a special category of data. Article 9(1) GDPR prohibits processing it in principle; Article 9(2) allows it, among other things, for medical diagnosis and for the provision of health or social care, on the basis of EU or national law or a contract with a health professional – provided that, under Article 9(3), the data are processed by or under the responsibility of a professional bound by professional secrecy, or by another person bound by a duty of secrecy, under EU or national law or rules of national competent bodies. In Germany, section 22(1) Nr. 1 b BDSG builds on this for health purposes, and section 22(2) BDSG requires appropriate and specific safeguards to protect the interests of the data subject.

Transparency is a duty of the controller. Articles 13 and 14 GDPR require the controller to inform people about the processing of their data – at the time of collection if the data come from the person (Article 13), and, for data obtained elsewhere (for example about relatives), within a reasonable period and at the latest within one month (Article 14(3)(a)) – earlier if the data are used to contact the person or are passed on to another recipient (Article 14(3)(b) and (c)). Article 14(5) contains exceptions, including where the person already has the information or where the data are subject to professional secrecy. In practice you will usually meet this as an information sheet or consent form that your employer provides – use the employer’s forms and ask if you are unsure.

Social data protection in social services

Social data (Sozialdaten) are personal data that a body named in section 35 SGB I processes for its tasks under the Social Code (section 67(2) SGB X). Under section 35(1) SGB I, everyone has a claim that benefit providers do not process social data about them unlawfully (the Sozialgeheimnis); the providers must also ensure internally that only authorised staff have access. Under section 67b(1) SGB X, a body covered by section 35 SGB I may store, use or transfer social data only insofar as the data protection provisions of SGB X or another provision of the Social Code permit or require it. Where consent is obtained, section 67b(2) SGB X provides that it should be given in writing or electronically (for health data it has to be, unless special circumstances justify another form), and the person must be told about the purpose, the consequences of refusing and the right to withdraw consent at any time. Section 35(3) SGB I adds that where passing on social data is not permitted, there is no duty to give information, testify or hand over files.

Kita: photos and developmental documentation

Day-care centres handle sensitive material every day: names, addresses, family situations, health information, observations of each child’s development. Under the GDPR principles above, the Kita should collect only what it needs for a defined purpose and should keep it secure. Photos of children are personal data, so taking and using them – for the portfolio, the notice board, a newsletter or the website – needs a legal basis under Article 6(1) GDPR. In practice, Kitas usually ask the persons with custody for consent (Article 6(1)(a) GDPR), separately for each purpose and preferably in writing so that it can be demonstrated (Article 7(1) GDPR). Consent can be withdrawn at any time; this does not affect earlier use (Article 7(3) GDPR). For distributing or publicly displaying a portrait, section 22 of the Art Copyright Act (KUG) also requires the consent of the person shown, with exceptions in section 23 KUG. How the KUG and the GDPR fit together is not fully settled (the Kita’s procedure and its provider’s data protection rules decide; church-run providers can have their own data protection law). Staff should never decide on their own to publish a photo.

Developmental documentation (Beobachtung und Dokumentation) contains very personal information about the child and the family. Write factually and respectfully, keep the files in the place your Kita specifies, and give information to third parties – for example a school, therapists or the youth welfare office – only on the basis of consent or a legal provision that your management has confirmed. If youth welfare law applies to the facility, the social data rules above may also be relevant.

Messaging apps and private phones

Do not use private messaging apps or your private phone for names, photos or health information of clients, residents or children unless your employer has expressly allowed it and has set up the tools and rules. This is general professional knowledge: the principle of integrity and confidentiality (Article 5(1)(f) GDPR) puts the responsibility on the employer to provide secure channels, and a private chat group is often not one of them. Ask your management which approved tools exist, how photos are handled, and what to do with a message that reaches your private phone by mistake.

Relatives and other third parties

Relatives, neighbours, the family doctor, a school or a landlord often ask questions – at the door or by phone. Before you share anything, clarify who is asking and on what basis you may answer: the person’s own consent (or that of a representative with authority, such as a person with a power of attorney, a legal guardian/deputy (rechtlicher Betreuer) for the relevant area of responsibility or, for children, the persons with custody), or a legal provision that your employer confirms. Consent should be recorded in the way your employer prescribes. If you are not sure, say that you will ask your colleague or manager and get back to the caller. This applies to messages, e-mails and text messages in the same way. The courses on working with relatives and on legal custodianship, listed below, cover related topics.

What to do after a data breach

A data breach (Datenschutzverletzung) can be small: a document left on the printer, an e-mail to the wrong address, a lost phone with work data, a photo sent to the wrong group. Tell your manager and, where there is one, your data protection officer (Datenschutzbeauftragte) immediately and follow the employer’s procedure – do not try to fix or hide it alone. The legal reporting duty lies with the controller: under Article 33(1) GDPR it notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. A processor must report to the controller without undue delay (Article 33(2)). Whether the deadline and the duty apply in a particular case is for the controller to assess, which is why a quick internal report matters.

A short checklist for your first weeks

• Ask for your employer’s confidentiality declaration, data protection instruction and procedures, and keep them to hand.
• Find out who the data protection officer is and whom to tell about a breach.
• Share information only with people who need it for the task, and only on a clear basis – consent, authority or a legal provision.
• Use only the devices, apps and storage places your employer has approved.
• Check consent for photos before you take them; ask when the form is missing.
• When in doubt, pause and ask your manager before answering a third party.

Recognition and employer information – neutral facts and official links

10 self-study courses in English: confidentiality and documentation

See all English self-study courses →

Care and nursing

Kita

Social work and documentation

More guides in English

Prices · 12-month access to all self-study courses

Free 14-day trial for teams, invoice and more than 20 people → · Questions? Contact us →

Questions

Sources

GermanSocialLab offers self-study courses with voluntary self-reflection (not graded) and a confirmation of participation after working through all modules. Legal status: 1 November 2026. This guide describes the situation in Germany in general terms; it provides professional information and does not constitute legal advice or recognition advice. Rules can differ between the 16 federal states (Länder) and between employers – always follow your employer’s procedures and ask the competent authority. Created with AI assistance and editorially reviewed.