Personal data breaches under Section 169 TKG: notifying authorities and affected persons

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, Regulation (EU) 611/2013 and the GDPR as published in the Official Journal, checked on 6 November 2026. This page provides general information, not legal advice. Whether a specific breach must be notified and whom you must inform is a data protection question for the individual case. Clarify it with your data protection officer and, if in doubt, with a lawyer admitted in Germany. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.

When is there a personal data breach?

Whenever a breach of data security leads to the loss, unlawful erasure, alteration, storage, disclosure or other unlawful use of personal data, and whenever there is unlawful access to such data. This is the definition in Section 3 no. 71 TKG. Unlike Section 168, Section 169 has no significance threshold: under Article 2(1) of Regulation (EU) 611/2013 every breach must be notified to the authority. Anyone who, in operations, gains unauthorised knowledge of the content or the detailed circumstances of a communication also touches on the secrecy of telecommunications under Section 3 TDDDG.

Examples are invoices or itemised call records sent to the wrong recipients, unauthorised access to the customer database, a lost device holding customer data, or a service provider whose system has been compromised. A mere suspicion does not yet trigger the duty to notify. Under Article 2(2) of the Regulation the breach counts as detected as soon as the provider has enough information to make a meaningful notification. The deadline runs from that point.

Who has to notify under Section 169?

Providers of publicly available telecommunications services, such as internet access, telephony or e-mail for end customers. Section 169 does not mention operators of public telecommunications networks that do not provide such a service themselves. Whether your company provides a publicly available service is explained on the page am I a telecom provider?

If another operator of a publicly available service without its own customer relationship has been commissioned to deliver part of your service, it must inform you immediately of a breach (Article 5 of the Regulation). Other service providers, for example for billing, hosting or the customer portal, must in the view of the BfDI be contractually obliged to inform you without undue delay, so that you can meet your notification duty. The provider with the customer relationship makes the notification.

To whom, how and by when?

Notifications always go to both authorities, the Bundesnetzagentur and the BfDI, not to the Federal Office for Information Security (BSI). Section 169 itself requires notification “without undue delay”. Regulation (EU) 611/2013, which applies directly, specifies this:

The BfDI provides a notification form (as of February 2022), intended only for providers of publicly available telecommunications services. Information that is not yet known in the first hours may be left open as “not yet known”. According to the BfDI, the form must be completed in full for every follow-up notification, because the latest notification always counts as current, and sent to both authorities again. The BfDI page and the form do not give the same e-mail addresses for the authorities. The BfDI page on the procedure under Section 169 TKG (German) is authoritative, and it also provides a PGP key for encrypted transmission.

Every notification must at least state the nature of the breach, contact points for further information and recommendations for limiting adverse effects. Notifications to BNetzA and BfDI must also cover the consequences of the breach and the measures planned or taken (Section 169(2)). Section 42(4) and Section 43(4) of the Federal Data Protection Act (BDSG) apply accordingly: in our reading, the notification may only be used in criminal or administrative fine proceedings against the notifying party with its consent.

When must affected persons be notified?

Under Article 3(1) of Regulation (EU) 611/2013, when the breach is likely to adversely affect the personal data or privacy of the persons concerned. Section 169(1) sentence 2 TKG requires that end users or other persons are seriously affected in their rights or legitimate interests. The Regulation names circumstances for the assessment: the nature of the data, in particular financial data, location data, internet log files, web browsing histories, e-mail data and itemised call lists; the likely consequences such as identity theft, fraud or damage to reputation; and the circumstances, for example whether data were stolen. The notification must be clear and easy to understand and must not be used for advertising.

The Regulation applies directly and takes precedence over conflicting national law. In our reading its lower threshold therefore applies; if in doubt, a lawyer can give a binding answer. A decision not to notify should be justified in writing against the criteria of the Regulation.

Encryption exception: Under Section 169(1) sentence 3, notifying affected persons is not required if the security concept demonstrates that the data were protected by appropriate technical measures, in particular secure encryption. The BfDI adds that the evidence can also be provided outside the concept, that notification of the authorities remains mandatory in every case, and that a data loss after which the data are no longer available to the provider may require notification despite encryption. The BNetzA can order notification regardless. How encryption is described in the concept is shown on the page security concept under Section 166 TKG.

What goes into the inventory of breaches?

Under Section 169(3) every provider keeps an inventory of all breaches with the circumstances, the effects and the remedial measures taken. The entries must allow BNetzA and BfDI to check whether notification of the authorities and of affected persons was correct. Breaches more than five years old no longer need to be included. An example entry is in the scenario below.

What else does Section 169 cover?

Subsections 4 to 7 deal with disruptions caused by users' equipment, such as infected routers: the provider informs the users known to it, which is mandatory after the BSI has reported specific significant threats, and may restrict or redirect use or filter traffic to and from sources of disruption if the user does not remedy the problem. These subsections have nothing to do with notifying a personal data breach under subsection 1.

How does Section 169 relate to Section 168 TKG and Article 33 GDPR?

Three reporting routes can apply to the same incident. The table sets them side by side:

Section 168 and Section 169: The two duties apply side by side. The Act does not count one notification towards the other (our derivation from the wording). An attack on customer data can therefore trigger a report to BNetzA and BSI under Section 168 and a notification to BNetzA and BfDI under Section 169. The stages under Section 168 are explained on the page incident reporting under Section 168 TKG.

Section 169 and the GDPR: Under Article 95 GDPR the Regulation imposes no additional obligations on providers where the ePrivacy Directive pursues the same objective. The BfDI concludes that where only data are affected for which the Telecommunications Digital Services Data Protection Act (TDDDG) contains its own rules, Section 169 applies. In mixed cases, where the same incident also breaches GDPR provisions, a notification under Section 169 is sufficient in the view of the BfDI, for example for traffic and customer data. This is the authority's view, not the wording of the law. According to the BfDI, other cases follow Article 33 GDPR; in our reading this covers, for example, a breach that affects only employee data or data from another line of business.

Decision tree: which reporting route?

The decision tree is our derivation from the Act, the Regulation and the guidance of the BfDI. It helps you not to overlook anything in an emergency and does not replace the assessment of the individual case.

Example: mixed-up itemised call records at a municipal utility

Fictitious example, not a client. A municipal utility (Stadtwerk) offers internet access and telephony to around 8,000 households and business customers through its telecoms arm. After an update of the billing system, 140 invoices are sent by e-mail with another customer's itemised call record. We count the deadline from the point at which the utility knows enough for a meaningful notification. When that is the case in legal terms has to be assessed in the individual case.

This is what the entry in the inventory under Section 169(3) can look like, all details invented:

Three typical gaps

If you want to review your procedures for Section 168 and Section 169 together, start with the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.