Each of the federal states, too, has a commissioner for data protection. Business enterprises which process data must likewise have a company data protection officer. Private companies’ compliance with data protection provisions is monitored by the supervisory authorities pursuant to the Federal Data Protection Act; as a rule, there must be grounds for such monitoring.

The constitutional significance of data protection emerged in a 1983 ruling of the Federal Constitutional Court. It held that under Article 2 of the Basic Law the citizen has the right to determine himself whether his personal data may be disclosed and how it may be used. As a consequence of this ruling, the Federal Data Protection Act was updated and area-specific data protection regulations were created (in the Social Code, for instance, in the law pertaining to registration and in the police laws).