With the entry into force of the German Data Act Implementation Act (DADG) on 30 May 2026, the legislator has determined, among other things, which authorities are responsible for monitoring compliance with the Data Act and how violations can be prosecuted. The Federal Network Agency will be the central supervisory and enforcement authority for the Data Act in Germany. In addition, the Federal Commissioner for Data Protection and Freedom of Information (BfDI) remains responsible for monitoring the processing of personal data by non-public bodies. Supervision of public bodies under data protection law remains the responsibility of the respective data protection supervisory authorities of the federal states. The law thus provides for a division of responsibilities between several authorities.

The DADG also regulates complaints procedures, investigative and enforcement powers and sanctions. Depending on the type of infringement and the size of the company, fines of up to two per cent of annual global turnover can be imposed. Companies that are affected by the provisions of the Data Act must therefore not only comply with the material obligations of the regulation in future, but also expect official inspections and formal proceedings.

„With the entry into force of the DADG, the Data Act has a fully functional enforcement framework in Germany for the first time,“ explains lawyer Zeynep Kenar. „Companies should check whether they have already implemented the requirements of the regulation. Because with the definition of responsibilities and sanction options, official control has now also arrived in practice.“