Law: Hamburg Data Protection Act (HmbDSG) of 18 May 2018 (only available in German here)

Regulator: The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI)

Summary: Hamburg implemented the GDPR through the Hamburg Data Protection Act of May 18, 2018 (HmbDSG) (only available in German here) which came into effect on May 25, 2018.

The HmbDSG provides for derogations from the GDPR and data protection requirements within Hamburg, including particular requirements for certain processing situations, such as handling employee data, video surveillance, and processing for research purposes.

The Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI) is the supervisory authority under the HmbDSG. The HmbDSG is relatively active and has issued notable fines in the past and has issued guidance on various topics including a checklist for using Large Language Models (LLMs) based chatbots.