Why Germany is uniquely complex
Germany operates one of the most worker-protective remote-work environments in the world. Before rolling out any new collaboration tool at a German company, you typically need to consider:
- Mitbestimmung (co-determination): Works councils (Betriebsrat) have formal rights to be involved in tool adoption that affects working conditions
- BetrVG (Works Constitution Act): Section 87 gives the Betriebsrat veto power over surveillance-capable tools
- BDSG and EU GDPR: German data protection law adds requirements on top of GDPR
- Arbeitsstättenverordnung: Workplace regulations that increasingly cover remote setups
- Bildschirmarbeitsverordnung: Display-screen work regulations that affect software ergonomics
A virtual office tool can hit all five of these. Picking the wrong tool — or rolling it out without proper consultation — creates legal risk that takes months to unwind.
What the Betriebsrat actually cares about
The works council is not anti-technology. What it pushes back on:
1. Performance monitoring features. Activity tracking, screen capture, keystroke logging — even if you never plan to use them — count as surveillance-capable. The Betriebsrat will require those features to be disabled by configuration, not just by policy.
2. Recording without consent. Default-on call recording will get blocked.
3. Cross-border data transfers. Even with SCCs, transfers to the US trigger scrutiny.
4. AI-driven scoring. Anything that could rank employees against each other is high-risk.
5. Lack of transparency. Vendors that won't disclose what they log or how they use data will face hard pushback.
A good rule of thumb: if a feature could plausibly be used to monitor or rank employees, default it to off and require explicit opt-in.
What German DPOs check
Beyond the standard GDPR checklist (see our GDPR guide), German DPOs also look at:
- BDSG-specific employee data rights
- Whether the vendor has a German entity (simplifies legal recourse)
- ToM (technical and organizational measures) documentation
- ISO 27001 certification — common requirement in mid-sized and larger German companies
- C5 testing report from BSI (the German federal cybersecurity office)
The German virtual office shortlist
Remotly
- EU-hosted (Frankfurt region)
- DPA available; sub-processors published
- No default-on activity monitoring
- Call recording is opt-in per call, with notice to all participants
- Free forever — works for Mittelstand SMEs that don't want capex
- AI features are opt-in
- Start free
Microsoft Teams
- The default in German enterprise
- Strong compliance posture; widely accepted by Betriebsräte after careful configuration
- Watch the analytics and activity-reporting modules — those are the parts that get co-determination scrutiny
- Likely already in your M365 contract
Wire
- German-developed, end-to-end encrypted
- Strong fit for legal, financial, and government sectors
- Less full-featured as a "virtual office" — more secure messaging + calls
Stackfield
- Made in Germany, hosted in Germany
- Strong choice for companies that want a "German end-to-end" answer
- Smaller ecosystem, fewer integrations
Avoid by default
- US-hosted tools with no clear EU Data Boundary
- Tools that ship with activity monitoring on by default
- Vendors that refuse to negotiate DPA terms
A typical German rollout
For a 200-person Mittelstand company, the workflow that succeeds:
1. Internal alignment. HR + IT + Datenschutzbeauftragter (DPO) agree on shortlist.
2. Betriebsrat consultation. Present the candidate tool, the data it would process, and the configuration choices. Address surveillance concerns explicitly.
3. Configure for safety. Disable activity tracking, set call recording to opt-in, configure data retention.
4. Pilot with one team. 30-60 days. Document any issues.
5. Betriebsvereinbarung. Negotiate a works agreement covering how the tool will be used. This is binding for both employer and employees.
6. Roll out. Train teams. Provide a clear escalation path for concerns.
The whole process from "we want a virtual office" to "everyone is using it" typically takes 3-6 months. Trying to shortcut this creates more problems than it solves.
Frequently asked
Does Remotly track employee activity?No. The product has no keystroke logging, no idle-time tracking that's exposed to admins, and no productivity scoring. Time tracking is user-initiated and visible only to the user and their direct lead.
Can we host in Germany specifically (not just EU)?Frankfurt region today. We can sign a data-locality commitment as part of an enterprise contract.
Does the Betriebsrat need to approve adoption?For most virtual office features, yes — at minimum a consultation under BetrVG §87. We can provide a "Betriebsrat-ready" feature summary that explains what each capability does and how to configure it.
Is there a German-language UI?Yes. Full German localization on the roadmap and partially live; English UI is comprehensive today.
Further reading
- GDPR-compliant virtual office software
- Best virtual office UK distributed teams
- EU remote-work directive tools
Looking for a Betriebsrat-friendly virtual office? Start with Remotly free — EU-hosted, no default monitoring, transparent processing.