The Bundesdatenschutzgesetz (federal privacy law) is, as the name says, federal law. I have not heard of states imposing their own data privacy laws on businesses. It may however be true that the administrations of each state have slightly differing privacy requirements for their own systems.
Those regulate how personal data has to be handled within the state and communal administrations. Those regulations concern private businesses in so far as administrative tasks are delegated to the corporate sector.
My lawyer told me that individual German states have individual privacy laws. This was in reference to my company and the user data of German citizens.
