![](\"https:\/\/cdn.pblzr.de\/dacbb27c-1270-4041-b681-e2b95f06f8a1\/2026\/09\/bitkom-logo-400x300_2_TEXT.jpg\"){kind=logo}
<\/p>\n<\/p>\n
“Companies want data protection to work. Eight years into the GDPR, the findings are clear: the administrative burden continues to grow, legal uncertainty persists, and the supervisory authorities offer little support,\u201d says Susanne Dehmel, a member of Bitkom\u2019s Executive Board. “With the Digital Omnibus, there is now a proposal on the table at the EU level to reform the European GDPR that could provide some relief, at least in certain areas.”<\/p>\n
The ongoing burden is leaving its mark on companies\u2019 fundamental attitudes. Only one in two companies (49 percent) believes that a high standard of data protection is fundamentally important for our society. And likewise, only 49 percent consider data protection a competitive advantage for Germany and Europe. This contrasts with 71 percent who say data protection hinders digitalization in Germany, and just as many who believe it is virtually impossible for smaller companies to implement. Seventy percent believe we go too far with data protection in this country, while 62 percent say German companies are overcompensating out of fear of violations. \u201cA good reform would not weaken data protection but rather strengthen its effectiveness and acceptance,\u201d says Dehmel.<\/p>\n
The vast majority of companies are struggling under the burden that data protection entails. 92 percent describe it as high, and 42 percent even as very high. And it\u2019s growing: In 71 percent of companies, the burden continued to increase last year, and in 22 percent, it increased significantly. It has decreased in only 2 percent of companies.<\/p>\n
The overall assessment of the GDPR is also deteriorating year after year. 88 percent now say the GDPR makes their business processes more complicated. In 2025, the figure was 81 percent; in 2024, it was just 77 percent. 76 percent believe that German data protection authorities apply the GDPR too strictly, up from 69 percent the previous year and 64 percent the year before that. Conversely, only 61 percent now say that data security within their own companies has improved as a result of the GDPR; in 2024, that figure was still 70 percent.<\/p>\n
The greatest burden is caused by the requirement to document processing activities, which 84 percent cite, up from 73 percent the previous year. This is followed by clarifying legal requirements at 68 percent (2025: 57 percent), technical implementation at 65 percent (2025: 69 percent), fulfilling information obligations at 61 percent (53 percent), and ensuring data subjects\u2019 rights at 51 percent (43 percent). For 48 percent, coordinating with external service providers is time-consuming (2025: 54 percent); for 43 percent, assessing data protection violations (2025: 36 percent), for 37 percent, building internal data protection expertise (2025: 33 percent), and for 33 percent, training employees (2025: 36 percent). As in the previous year, appointing a data protection officer ranks last at 25 percent. Not a single company reports having no data protection-related issues.<\/p>\n
The biggest challenges come from outside the company. 88 percent of companies complain about uncertainty regarding the exact data protection requirements, while 83 percent cite the fact that implementation is never fully complete because they must constantly adapt to legal developments. 78 percent simply consider the requirements to be too high. 70 percent say that rolling out new tools repeatedly triggers a new data protection review, and 61 percent complain about a lack of guidance from supervisory authorities. These are followed by the time required for IT and system changes (56 percent), conflicting legal requirements (55 percent), and inconsistent interpretations of data protection within the EU (49 percent) and within Germany (32 percent). Internal factors, by contrast, play a minor role: 42 percent lack qualified personnel, 40 percent lack financial resources, 39 percent find it difficult to explain the complex requirements to employees, and 27 percent cite a lack of involvement by data protection officers. Only 10 percent cite a lack of support from management, while 9 percent cite a general lack of support within the company.<\/p>\n
Those who contact the supervisory authorities with questions often receive no response. 37 percent of companies have requested assistance in the past two years and received no response. A quarter did not even make a request. At the same time, 64 percent\u2014nearly two-thirds\u2014have utilized assistance from the supervisory authorities: 33 percent have sought help once, and 31 percent have done so multiple times. Two years ago, that figure was only 54 percent. However, those who received assistance rated it only a 2.9 on a school grading scale\u2014down from a 2.7 in 2024. Fifteen percent gave it an \u201cA,\u201d while 8 percent rated it \u201cPoor\u201d or \u201cFailing.\u201d<\/p>\n
The expectations for reform are correspondingly clear. Of the 93 percent of companies that see a need for reform, 85 percent want to see data protection oversight centralized in Germany, and 80 percent want it centralized at the EU level. Eighty-two percent call for better coordination among authorities, 76 percent want a central database of all supervisory decisions, 70 percent want standardized reporting processes for data protection violations, and 67 percent want mutual recognition of decisions made by supervisory authorities. Two out of three companies (66 percent) simply want faster responses to inquiries and complaints, while about one-third (31 percent) want better accessibility. A narrow majority of 54 percent advocates for the establishment of supervisory authorities focused on specific thematic areas, while 48 percent would like to see more flexibility in the interpretation and application of data protection laws. And at 34 percent, one in three companies supports the call for consistent action against violations. \u201cIf one in three companies receives no response at all to an inquiry to the supervisory authority, that is not a minor issue, but a structural one,\u201d says Dehmel. \u201cSixteen supervisory authorities, some with differing interpretations, also tie up resources that are lacking in advisory and enforcement efforts. Companies consider consolidating oversight to be a sensible measure.\u201d<\/p>\n
When asked which simplifications to the GDPR would actually help, the answer is clear: 89 percent of companies cite fewer documentation requirements for low-risk processing. 76 percent want a uniform interpretation by data protection authorities, 73 percent want greater legal certainty when balancing interests, and 69 percent want better coordination with other regulations such as the AI Act. 62 percent want a data breach reporting requirement only for high-risk incidents; 61 percent want fewer consent requests for cookies and tracking; and 55 percent want reduced information requirements. 47 percent believe that simplified use of pseudonymized data would ease their burden; 44 percent want more opportunities for data processing without consent; and 40 percent want better templates and practical examples from supervisory authorities. Ironically, the issue currently being debated most heatedly in Germany is the one mentioned least often: Only 35 percent of companies say that eliminating the requirement for mandatory in-house data protection officers would ease their burden. Not a single company reports that there is no area where simplification would help.<\/p>\n
The use of artificial intelligence is creating new challenges for data protection officers. 79 percent of companies say data protection must be adapted to the AI era, up from 71 percent last year. 57 percent call for allowing the use of personal data for the development and training of AI systems based on legitimate interest. 78 percent report that data protection reviews of AI projects are becoming increasingly time-consuming; for 72 percent, data protection in AI applications is a major issue within their own organizations. At the same time, 56 percent of respondents admit that they often feel overwhelmed by data protection issues related to AI. 51 percent see AI chatbots as a helpful resource for employees regarding data protection questions. Half (50 percent) say that data protection is hindering the use of AI within their own companies.<\/p>\n
But it\u2019s not just AI\u2014other innovative technical solutions are also being held back by data protection concerns. Four out of 10 companies (42 percent) have already opted out of products or solutions from countries outside the EU due to data protection concerns; 19 percent have done so multiple times. This primarily affects providers from China, which 59 percent of these companies cite, and from the U.S., at 39 percent. India and other countries outside the EU each account for 10 percent. \u201cThe business community is not calling for data protection deregulation, but rather proportionality,\u201d says Dehmel. \u201cIf low-risk processing activities are exempted from documentation requirements, this ensures a uniform interpretation, aligns data protection with AI regulation, and significantly reduces the burden on companies without lowering the level of protection.\u201d<\/p>\n
– – – – –<\/p>\n