§ 203 STGB · PROFESSIONAL SECRECY

§ 203 StGB and PDF redaction

The 2017 reform enables professional secrecy holders to outsource to the cloud under conditions (§ 203 Abs. 3 S. 2 StGB i. V. m. § 43e BRAO). Datenmaske Desktop goes one step further: redaction runs locally on your machine — client data never leaves your device, there is no involved third party in the editorial path.

FOUNDATIONS

What § 203 StGB regulates

§ 203 StGB (violation of private secrets) criminalizes the unauthorized disclosure of another person's secret. It covers professional secrecy holders who receive trust in the course of their work — the protection applies to the client or patient secret, not merely to personal data.

§ 203 Abs. 3 S. 2 StGB extends the duty of confidentiality to involved persons whom the professional secrecy holder uses for processing — and thus precisely to IT service providers and cloud providers. It is flanked at the professional-law level by § 43a BRAO (lawyer confidentiality) and § 43e BRAO (outsourcing regulation).

Affected professional groups (selection)

· Lawyers (§ 203 Abs. 1 Nr. 3 StGB, § 43a BRAO)
· Tax advisors / tax representatives (§ 203 Abs. 1 Nr. 3b, § 57 StBerG)
· Auditors (§ 203 Abs. 1 Nr. 3b, § 43 WPO)
· Notaries (§ 203 Abs. 1 Nr. 6, § 14 BNotO)
· Doctors, psychotherapists (§ 203 Abs. 1 Nr. 1)
· Pharmacists, midwives, nursing staff (§ 203 Abs. 1 Nr. 2)

REFORM 2025

Three conditions for permissible outsourcing

The “Act on outsourcing in law firms” makes the involvement of external IT service providers legally permissible for professional secrecy holders subject to the following conditions:

1

Necessity

The service provider must be necessary for the proper practice of the profession (§ 43e BRAO) — mere convenience is not sufficient.

2

Confidentiality agreement

The IT service provider and all involved persons are bound in writing to confidentiality (§ 203 Abs. 4 StGB, § 43e Abs. 3 BRAO). For the cloud route this is the central contractual safeguard.

3

Technical and organizational measures

Appropriate TOMs (Art. 32 DSGVO), review of the service provider and documentation of the commissioned service (§ 43e Abs. 1 u. 5 BRAO).

Note: The exact scope of § 203 Abs. 3 S. 2 StGB for IT service providers and the assessment under Union law (CLOUD Act for US providers) must be examined on a case-by-case basis through legal advice. Datenmaske does not provide legal advice — see below.

TWO PATHS

How Datenmaske can be deployed

DATENMASKE DESKTOP · AVAILABLE

Local redaction

The PDF is processed entirely on your machine. There is no involved third party and no data transfer — the trigger for § 203 Abs. 3 S. 2 StGB (outsourcing) does not apply. Client secrets never leave your IT.

DATENMASKE SECURE · IN PREPARATION

EU-hosted, under conditions

For the cloud edition the outsourcing requirement of § 43e BRAO is being prepared: DPA (Art. 28 DSGVO), confidentiality agreement and TOMs. Available as soon as a § 203-compliant server provider is finalized and the contractual basis is concluded.

HONESTY

What Datenmaske is not

— No “§ 203 certificate”. There is no state certification for the § 203 compliance of a software. Datenmaske provides the technical architecture (local processing or documented TOMs) — the labor-law and professional-law assessment in each individual case is the responsibility of your firm or practice.
— No legal advice. This page is product information, not a legal service. For contractual and professional-law assurance, contact your bar association or a specialist lawyer.
— No substitute for review. AI suggestions must be reviewed by the user (AGB § 3(5)). Detection completeness is a best-effort process and does not replace human review before disclosure.

SOURCES