§ 2 BDSG
Definitions
(1)Public bodies of the Federation shall mean the authorities, bodies of the administration of justice and other entities organised under public law of the Federation, the immediate federal public-law corporations, institutions and foundations as well as their associations irrespective of their legal form. If a non-public body is entrusted with tasks of federal public administration, the provisions of this Act shall apply to it as if it were a public body of the Federation.
(2)Public bodies of the Länder shall mean the authorities, bodies of the administration of justice and other entities organised under public law of a Land, a municipality, an association of municipalities or other legal persons under public law subject to the supervision of a Land as well as their associations irrespective of their legal form.
(3)Associations of public bodies of the Federation and the Länder, irrespective of their legal form, shall be deemed to be public bodies of the Federation where they are predominantly composed of public bodies of the Federation. If no such predominance exists, they shall be deemed to be public bodies of the Länder.
(4)Non-public bodies shall mean natural and legal persons, companies and other associations of persons under private law, insofar as they are not covered by Subsections (1) to (3). If a non-public body performs sovereign functions, it shall be a public body within the meaning of this Act. The non-public body may, in this case, store the personal data separately from data for other purposes in a separate filing system.
(5)Public bodies of the Federation which are public-law undertakings participating in competition shall be subject, with respect to such activities, to the provisions of this Act applicable to non-public bodies, unless the processing of personal data serves the purpose of administration, including internal personnel management. Section 10 Subsection (2), Section ## Subsection (5), Section 16 Subsection (1), second to fourth sentences, and Section 16 Subsection (4) shall remain unaffected. Section 40 shall apply insofar as it goes beyond the provisions of Part One and Two. Section 38 shall apply with the proviso that the designation of a data protection officer shall be mandatory in all cases.