Of the European countries, Germany has always had the strictest data protection rules. This includes the legal framework that governs employer’s rights to process personal information of their employees, e.g. to do their payroll, or establish benefit schemes, during recruitment or in workforce investigations. The statutory rules applicable in Germany until May 24, 2018, the Old Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG-old), were based on the European data protection directive and provided for a comprehensive and restrictive scheme for the processing and transfer of personal data, including employees’ data in the workplace. On May 25, 2018, these rules were replaced by the new European General Data Protection Regulation (GDPR) which is binding in all EU member states.