Executive Summary
- According to Bitkom, the new Federal Commissioner for Data Protection and Freedom of Information has announced his priorities.
- Bitkom cites survey figures: 90% see a reform of the GDPR as necessary, 93% a reform of oversight, and 4% want to keep the status quo (according to Bitkom).
- Bitkom calls for risk-based, practical supervision that advises companies and provides quick, legally sound guidance.
- Bitkom points to the full survey results in the Bitkom‑Dataverse and gives details of the survey (according to Bitkom: 605 companies, telephone survey, calendar weeks 28–33/2026).
What happened?
According to Bitkom, the new Federal Commissioner for Data Protection and Freedom of Information has set out his priorities. In its statement, Susanne Dehmel, member of Bitkom’s management board, comments on business expectations of the new leadership. Bitkom also cites results from its own company survey: 90% of respondents support a reform of the General Data Protection Regulation, 93% support a reform of data protection supervision, and 4% would like to maintain the current situation. Bitkom Research states these figures are based on a telephone survey of 605 companies with at least 20 employees in Germany, conducted in calendar weeks 28–33/2026. Bitkom refers to further materials in the Bitkom‑Dataverse under the category “Data protection”.
Why does it matter?
The announced priorities and the conclusions drawn from the survey are relevant because they indicate potential regulatory developments that could shape the framework for data use and digital business models. Bitkom stresses that both negotiations in Brussels on the GDPR and national reorganisation of supervisory structures could affect the legal situation for companies for years to come. Bitkom sees a particular need for clear guardrails for new technologies such as AI, to limit risks from data use while preserving room for innovation. A practical, risk-based supervisory approach, as called for by Bitkom, would shift the role of supervisory authorities from pure enforcement to advisory accompaniment, thereby changing decision-making processes and compliance requirements within companies.
What does this mean for mid-sized companies?
A reorientation of supervision could have several consequences for small and medium-sized companies: changes in GDPR interpretation or supervisory structures affect documentation and audit obligations, legal bases for data processing, and requirements for technical and organizational measures. Bitkom explicitly states that mid-sized companies and startups need practical guidance and quick, legally sound answers. Concretely, this means companies should monitor the ongoing reform debates, review existing data protection processes for risk-based approaches, and pre-plan possible adjustments for data-intensive products (for example, those with AI components). At the same time, a more advisory supervisory approach could provide opportunities to clarify questions early and address legal risks more pragmatically, provided such offerings are actually implemented.
Related: AI Readiness Check
Recommendation from Future AI Solutions
Future AI Solutions recommends that decision-makers in mid-sized companies take the following steps to reduce regulatory uncertainty and remain operationally capable:
- Monitoring: Track announcements from the Federal Commissioner, developments at EU level on the GDPR, and publications from Bitkom and relevant supervisory authorities; document changes and deadlines.
- Legal stocktake: According to internal documentation, review your basic data protection measures and priorities with regard to a risk-based approach (DPIAs, records of processing activities, technical measures).
- Proactive communication: Use opportunities for dialogue with supervisory authorities and industry associations; prepare concrete questions and practical cases to obtain targeted guidance.
- Implementation compass for AI: Assess AI applications by risk to data subjects and prioritize measures that improve transparency, lawfulness and data security.
- Use of resources: Review the survey results and materials available in the Bitkom‑Dataverse as an additional information basis (according to Bitkom) and, if necessary, engage external data protection and compliance advice.
These steps are intended to help assess regulatory changes in a structured way and align operational measures with a risk-based, practical approach. Future AI Solutions offers support with monitoring, risk analysis and the implementation of data protection and AI compliance measures.