Law: Lower Saxony Data Protection Act (NDSG) of 16 May 2018 (only available in German here)

Regulator: Lower Saxony data protection authority (LfD Niedersachsen)

Summary: Lower Saxony implemented the GDPR through the Lower Saxony Data Protection Act of May 16, 2018 (NDSG) (only available in German here) which came into effect on May 25, 2018.

The NDSG provides for derogations from the GDPR and data protection requirements within Lower Saxony. The NDSG particularly focuses on processing purposes and outlines requirements and exemptions related to processing in the employment context, video surveillance, scientific research, and criminal proceedings.

The Lower Saxony data protection authority (LfD Niedersachsen) is the supervisory authority under the NDSG and has released guidance on a wide range of topics, including a breakdown of protection levels for technical and organizational measures under the GDPR, and website consent guidelines. The LfD Niedersachsen has also issued fines, including a €1.1 million fine in connection with a driving assistance system.