Facebook and WhatsApp promised in the wake of the Silicon Valley giant's 2014 acquisition of the messaging app that they would not share data, Hamburg's Commissioner for Data Protection and Freedom of Information Johannes Caspar said in a statement.
He added that Facebook would be required to delete any data already received from WhatsApp in Germany.
"It has to be (the users') decision whether they want to connect their account with Facebook," Caspar said. "Facebook has to ask for their permission in advance."
WhatsApp announced in August that it would begin sharing data with Facebook, in a bid to allow better targeted advertising and to fight spam on the platform.
Currently, users of the instant messenger must opt out of sending information to Facebook through WhatsApp's settings on their smartphone.
Caspar said that he had acted to protect the privacy of 35 million WhatsApp users in Germany - a fraction of some one billion worldwide - and that of people saved in their address books, whose details might also be forwarded under the data-sharing arrangement.
Facebook's activities in German-speaking regions are managed through its subsidiary in Hamburg, placing the firm under the jurisdiction of the regulator in the northern port city.
In a response, Facebook said it was ready to cooperate with the German authorities.
"Facebook complies with EU data protection law. We are open to working with the Hamburg DPA in an effort to address their questions and resolve any concerns," a spokeswoman for the company told AFP.
WhatsApp's announcement that it would share information with Facebook came just four months after the service introduced end-to-end encryption by default, saying that the content of messages would become unreadable for anyone except the sender and receiver.
In mid-September, the European Commission recommended tighter privacy and security requirements for services including WhatsApp and Microsoft-owned video calling service Skype, saying they should be regulated more like traditional telecoms.
Subjecting the internet firms to such rules could force them to offer emergency calling services and to obey stricter privacy rules.