The essential Difference between data protection and information security lies in the fact that data protection focuses on the right to informational self-determination and the protection of personal data, whereas information security aims to secure data in systems. Data protection thus protects data of citizens and information security protects data of companies. However, since personal data is also processed in companies, there is often an overlap between data protection and information security.
However, another significant difference is that the implementation of data protection is regulated by law via the General Data Protection Regulation (GDPR). For the implementation of information security, there is indeed the guideline for information security of the BSI, however, it is not a legal basis. This allows companies to introduce different concepts.