Law: Hamburg Data Protection Act ('HmbDSG') of 18 May 2018 (only available in German here)

Regulator: The Hamburg Commissioner for Data Protection and Freedom of Information ('HmbBfDI')

Summary: The HmbDSG provides for derogations from the General Data Protection Regulation (Regulation (EU) 2016/679) ('GDPR') and data protection requirements within Hamburg, including particular requirements for certain processing situations, such as handling employee data, video surveillance, and processing for research purposes. The HmbDSG also sets out obligations related to, among other things, obtaining personal data from third parties. The HmbBfDI is a relatively active authority and has issued notable fines in the past.