Biobanking in Germany is currently not subject to sui generis regulation. Instead, a plethora of norms from differing areas of law form the bundle of regulation that applies to biobanking. The exact shape and extent of the bundle depends on the exact configuration of the biobank. In the context of data protection, the rather fragmented nature of the regulation is to a certain extent alleviated by the direct impact of the EU General Data Protection Regulation (GDPR). In particular, the federalized system of data protection in Germany is simplified by an overarching set of norms that apply equally across the board. Whilst this is a welcome systematization of this part of the regulation of biobanking in Germany, the exact nature of the implementation of the Regulation raises novel issues in its own right. In this paper, I will outline the fragmented nature of biobank regulation in Germany, illustrate the issues on the basis of Germany’s population biobank NaKo and then discuss some of the more significant issues raised by the GDPR in the context of biobanking.