Germany software delivery: the BDSG, works councils, accessibility and e-invoicing

OutsourcingVN is operated by Netbase JSC, so this guide comes from a supplier that would like your project. It draws on Germany's own statutory texts for the questions your legal and works-council advisers should answer, and on Netbase's published delivery and compliance statements. The guides index lists guides for other markets, and the market index compares the first question each one raises.

Contents

• How does German law sit on top of GDPR?
• Why does a works council matter for a monitoring-capable system?
• What can Netbase evidence for a German brief?
• Which requirement sits with which decision owner?
• Which steps come before a German-facing launch?
• Worked scenario: a support dashboard needs works-council agreement
• What has Netbase built in Europe?
• Which questions should you ask a supplier?
• What usually goes wrong?
• How this guide is sourced and where it stops
• Common questions
• Plan the first release

How does German law sit on top of GDPR?

Germany implements GDPR through the Bundesdatenschutzgesetz (BDSG), a federal act that fills the gaps GDPR leaves to member states rather than replacing the regulation itself. It sets specific rules for processing employee data under its own section on employment-related purposes, and it requires both public bodies and many private organisations to appoint a data protection officer once certain thresholds are met. Supervision is federal rather than centralised in one office: the Bundesbeauftragte für den Datenschutz (BfDI) supervises federal bodies, while each of the sixteen states runs its own data protection authority for organisations under state jurisdiction.

A buyer should confirm early which authority has jurisdiction over the system being built, who inside the business holds the data protection officer role, and how the BDSG's employee-data provisions apply if the product itself processes staff records.

Why does a works council matter for a monitoring-capable system?

Germany's Works Constitution Act (Betriebsverfassungsgesetz) gives an elected works council co-determination rights over social matters at a company, a category that reaches the introduction of technical devices capable of monitoring employee behaviour or performance. A system does not have to be built for surveillance to trigger this: a support dashboard that logs who handled which ticket, or an analytics tool that times a workflow step, can still fall inside it if the council judges that it could be used to watch performance.

Where a works council exists, the usual route is a works agreement (Betriebsvereinbarung) negotiated before the system goes live, not after staff notice it running. A buyer should name this as a project dependency as early as discovery, because a late works-council objection can hold up a release that is otherwise complete.

What can Netbase evidence for a German brief?

Procurement, security and data protection reviewers tend to ask the same four questions. Here is what Netbase can state.

• Delivery process. Netbase delivery runs with weekly reviews and a named project manager, which gives a works council and a data protection officer a fixed point to raise a question as the build progresses.
• Compliance practices. Netbase's compliance practices are GDPR alignment for data privacy in Europe, HIPAA-aligned methodologies for healthcare data handling, and CCPA compliance for clients with U.S. customer bases. How the BDSG's own provisions apply to a specific German product stays with your organisation's advisers.
• Security and certification. Security practices include secure code review and version control, role-based access control, MFA for admin dashboards, contributors under NDA, and NDAs and DPAs on request. Netbase JSC holds ISO 27001 certification for information security management, and Netbase JSC holds a SOC 2 Type II attestation; neither extends to a client's own product or hosting.
• Language. Netbase delivery communication is in English. German-language requirements, such as a works agreement text or German-language user interface copy, are scoped as a project task with a named German-speaking reviewer.

Which requirement sits with which decision owner?

A German brief usually involves four separate owners inside the buying organisation, and conflating them is the fastest way to lose weeks to a late objection.

Ask a shortlisted supplier to fill this table in for your specific product rather than accept a general compliance statement.

Worked scenario: a support dashboard needs works-council agreement

A project adds a dashboard that shows which support agent handled which ticket and how long each one took, to help a German subsidiary plan staffing.

A proposal that skips step 2 and goes straight to building the dashboard risks a signed, working feature that still cannot be switched on.

What has Netbase built in Europe?

The closest published example of comparable engineering work in Europe is a 3D product preview delivered for Rebelo AG, a printer in Portugal: a preview inside the online designer for boxes and other multi-sided products, configured by uploading a 3D model file per product, with a go-live timeline of about three and a half months. The Rebelo AG record names the client and the results it reported, and describes Portuguese delivery. The web-to-print stores record covers design-tool work across four countries and shows the same custom-engineering practice applied to European and Asian clients alike.

Which questions should you ask a supplier?

• Has your project plan named a works-council step, or does it assume there is none? A German subsidiary of almost any size may have one.
• What exactly does your logging or analytics feature record about individual staff? Write the answer down before the works council sees it, not after.
• Which data protection officer role applies, yours or ours? The answer depends on thresholds your advisers should confirm.
• Can your invoice export produce XRechnung or ZUGFeRD today? Ask to see a sample file, not just a claim that the format is supported.
• Who signs the works agreement, and where is it filed? It should sit with the project record, not in an email thread.
• What does your security and certification statement cover, and what does it not? A precise answer names the boundary.

What usually goes wrong?

• A monitoring-capable feature is built before the works council sees it. Signal: a finished feature that cannot be switched on. Owner: HR with the works council, consulted at discovery.
• BDSG is treated as identical to GDPR with a German label. Signal: no named data protection officer, no employee-data-specific review. Owner: the data protection officer.
• Accessibility is scoped only for the public sector. Signal: a private product skips testing because "BFSG is a public-sector law." Owner: the product owner, checking whether the widening private-sector duty applies.
• An invoice export is built once and never tested against XRechnung validation. Signal: invoices bounce at a public-sector buyer's gateway. Owner: the finance systems owner.

How this guide is sourced and where it stops

This guide uses the German government's own texts for the BDSG, the Works Constitution Act and the Accessibility Strengthening Act, the BfDI's description of its own supervisory role, and the XRechnung and e-Rechnung-Bund descriptions of German e-invoicing formats, all checked on 2026-10-03, together with company statements and a delivery record approved in the OutsourcingVN claim register. It is written for product, operations and procurement leads preparing a German-facing brief. It does not decide whether a works council exists at your organisation or which accessibility duty reaches your product; your own advisers confirm that.

Plan the first release

Bring your BDSG scope, your works-council status, your accessibility decision and your e-invoicing format. The data security and compliance guide lists the contract questions behind the data protection row, and the IP ownership guide covers who owns what a German-facing build produces. For neighbouring markets, the UK guide covers UK accessibility duties, the Netherlands guide covers Peppol e-invoicing and the Dutch supervisory authority, and the France guide covers CNIL guidance and the French e-invoicing reform.

Custom Product Engineering is the service for a bounded build, and global delivery explains how remote delivery is organised. OutsourcingVN is Netbase's own outsourcing-services platform: submit a project with your German-facing scope, and a person will reply with whether discovery or a bounded implementation is the right next step.

Related services and solutions