Customer data and information requests under Sections 172 to 174 of the German Telecommunications Act (TKG)

This page covers the data that telecom providers in Germany keep for information requests from security authorities and the three routes for such requests under Sections 172 to 174 of the German Telecommunications Act (TKG). Lawful interception is a separate topic, covered on the page Section 170 TKG and TKÜV.

Legal status: TKG as amended on 22 October 2026, Customer Data Information Ordinance (KDAV), guidance of the Bundesnetzagentur (BNetzA), the German Federal Network Agency, on Sections 172 and 173 TKG, version 1.1 of 7 November 2024, checked on 6 November 2026. Almost all sources are in German. This is general information, not legal advice. Whether and how an obligation applies to your company is a question for a lawyer admitted in Germany.

Customer data and the data set under Section 172

The TKG distinguishes two data sets. Customer data (Bestandsdaten) under Section 3 no. 6 TKG is the data of an end user needed to set up, shape, change or end a contract for telecom services. The data under Section 172 TKG is a fixed set that certain providers collect for the information procedures even if they do not need it for their business: numbers and other line identifiers they assign, name and address of the subscriber, date of birth for natural persons, the address of a fixed line, the device number of a mobile handset supplied with the contract, and the date the number was assigned or the contract began; the end date once known.

According to the Bundesnetzagentur, other line identifiers in practice mainly means the IMSI, and e-mail addresses only where the provider assigned them itself. Traffic data, the data that arises when a service is provided (Section 3 no. 70 TKG), and the content of communications are separate categories.

Who has to do what?

In our reading, most small providers therefore collect the Section 172 data if they assign numbers or line identifiers, answer manual requests under Section 174 and keep the e-mail procedure under Section 174(7). Automated retrieval under Section 173 only applies above the KDAV threshold. A pure internet access provider that assigns no telephone numbers is not covered by Section 173.

Section 172: collect, correct, delete

The data must be collected before activation and stored without delay; for the manual procedure the storage format is free. The BNetzA expects complete and accurate data and leaves the means to the provider. Known changes must be corrected without delay. A provider that uses a third party such as a sales partner remains responsible. The Section 172 data must be deleted at the end of the calendar year following the end of the contract; there is no compensation for collection and storage.

Section 173: automated retrieval and the KDAV threshold

Providers covered by Section 173 keep databases from which the BNetzA can retrieve data at any time, also with incomplete search terms and a similarity search. The BNetzA holds no database of its own and forwards the requests of nine groups of authorities automatically. The provider must ensure that it cannot see the data retrieved. Number blocks assigned to other providers and, for ported numbers, the current porting code belong in the databases. The technical details are in the technical directive TR-AAV, edition 2.0, in force since 25 July 2019. Equipment and operation are at the provider's expense and there is no compensation. The KDAV limits the obligation to providers of publicly available services that assign numbers and have more than 10,000 subscribers.

Section 174: manual information requests

Anyone who provides or contributes to telecom services may use customer data and Section 172 data to answer requests from the authorities listed in subsection 3, and anyone doing so on a business basis must transmit it without delay and in full. This includes data protecting access to devices or storage, such as PIN or PUK, and information on an IP address at a given time, for which traffic data may be analysed automatically and all internal data sources must be used.

The authority must make the request in the individual case, name the statutory provision that allows it to collect the data and make the request in writing or electronically. In urgent cases (Gefahr im Verzug) information may be given on a request in another form, which must then be confirmed in writing or electronically without delay. The requesting authority is responsible for the lawfulness of the request. Entitled are authorities prosecuting criminal and administrative offences, police authorities, the Federal Criminal Police Office and the Customs Criminal Investigation Office as central agencies, the domestic intelligence services, the Military Counterintelligence Service, the Federal Intelligence Service and the Federal Office for Information Security (BSI); for the BSI a transitional rule applies (Section 230(16) TKG). The provider must keep the request and the answer confidential towards the person concerned and third parties.

The interface under Section 174(7)

Providers of publicly available telecom services keep secured electronic interfaces under the Telecommunications Interception Ordinance (TKÜV) and the related technical directive. From 100,000 contract partners this means the interface and the e-mail procedure, below that only the e-mail procedure (called "E-Mail-ESB" by the BNetzA). A responsible specialist checks every request against the formal requirements before it is processed, unless the interface does this automatically.

The BNetzA expects a notification on its form (size class, own unit or contractor, planned start), and below 100,000 contract partners a concept based on its model concept for the e-mail procedure. Using a contractor is allowed; out-of-hours standby is not required according to the model concept. Logging follows Section 35 TKÜV and BNetzA unit 218 may check the arrangements on site. The current technical directive TR TKÜV edition 9.0 was published in the BNetzA Official Gazette 18/2026 on 23 September 2026. We do not supply interface or interception technology; we help with process, roles and documentation.

Costs and enforcement

Providers bear the cost of the arrangements for both procedures. Breaches of the collection, storage, correction and deletion duties under Section 172 carry fines of up to EUR 300,000, failing to ensure retrieval under Section 173 up to EUR 500,000, and breaching confidentiality under Section 174(6) up to EUR 50,000 (Section 228 TKG). In our reading, the maximum is halved for negligence. The interface under Section 174(7) and the duty to transmit under Section 174(6) sentence 1 carry no fine. The BNetzA can, however, enforce these duties under Section 183 TKG with orders, information requests, site visits and periodic penalty payments of up to EUR 1 million, and as a last resort with a full or partial ban on the service. After repeated breaches of certain duties under Sections 172 to 174, but not the interface under Section 174(7), it can also freeze the customer base. All offences with numbers and maximum amounts and the powers under Section 183 are on the page fines under the TKG.

Customer data in the security concept

Under Section 165(1) TKG anyone providing or contributing to telecom services must protect against breaches of personal data, and the security concept under Section 166 describes the measures for Section 165(1) to (7). In our reading, customer databases, the request mailbox and the request process therefore belong in the concept, with access rights, logging and deletion. Forged requests from people posing as authorities are a real risk, so the formal check by the responsible specialist is also a security measure. Data protection law applies alongside. More on the concept: security concept under Section 166 TKG. What the protective measures look like in detail is on the page protective measures under Section 165 TKG.

Example: information request process of a VoIP provider

Fictitious example, not a client. A VoIP provider with 25 employees offers publicly available telephony to business customers, assigns numbers from its own blocks and has around 6,000 subscribers and 900 contract partners. In our assessment it must collect the Section 172 data, answer manual requests and keep the e-mail procedure, but needs no databases for automated retrieval until it exceeds 10,000 subscribers.

Steps marked "recommendation" are our professional view; the law does not prescribe them. If the specialist has doubts about the entitlement or form of a request, they clarify them with the legal department or a lawyer before any data is released.

Three common gaps