Fines under Section 228 TKG and orders by the Bundesnetzagentur

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), the act on the Federal Office for Information Security (BSI), each as amended on 22 October 2026, checked on 6 November 2026. This page sets out the statutory maximum amounts and is not legal advice. How a specific proceeding is to be assessed is a question for a lawyer admitted in Germany. We have not analysed published fining decisions of the Bundesnetzagentur, so this page says nothing about how often and in what amounts fines are actually imposed.

How is Section 228 TKG structured?

Section 228(2) TKG lists the offences one by one, and subsection 6 assigns a maximum amount to each number. Anything not expressly named in subsection 6 nos. 1 to 5 falls under the catch-all limit of EUR 10,000 (subsection 6 no. 6). The following principles apply throughout this page:

• Maximum amounts: All amounts are upper limits per offence. There is no overall limit for "breaches of the TKG".
• Intent or negligence: Every offence requires one or the other (Section 228(2)).
• Negligence: Because Section 228 does not distinguish between intent and negligence in the maximum amount, the maximum is halved for negligence under Section 17(2) of the Administrative Offences Act (OWiG) (our reading).
• Turnover-based limits: The limits of 2 % and 1 % of total turnover in Section 228(7) and (8) concern other offences, none of the duties on this page.
• Competent authority: The fining authority is the Bundesnetzagentur, which also enforces the fines (Section 228(10) and (11)).

The draft TKG Amendment Act 2026 would reword Section 228(3) to (9). The limits for the security concept (no. 38) and the report under Section 168 (no. 39) would stay the same. For other offences, for example on customer data, the draft assigns the numbers differently, in our assessment partly through a drafting error. This page therefore covers only the law in force. The draft has not been passed: after the hearing on 4 November 2026, the second and third readings have not yet taken place (as of 6 November 2026).

Table of offences: which duty, which maximum amount?

The table sums up the offences that apply to operators of public telecommunications networks and providers of publicly available telecommunications services in the areas of reporting, security and customer data. It shortens the statutory wording and leaves out offences outside these topics.

Section 228 contains no offence for the duties in the following table. They apply all the same, and the BNetzA enforces them with orders (next section).

Are there fines for the protective measures under Section 165?

No. Section 228 TKG does not mention Section 165 anywhere: neither the protective measures, nor the ten minimum measures, nor the duties of management (our analysis of the wording, not a statement by the authority). What this means for management is explained on duties of management under Section 165 TKG.

The high limits of the BSI Act of up to EUR 10 million do not apply to telecom providers for their telecommunications activity either. They are tied to Sections 30, 32, 35 and 36 BSIG, which under Section 28(5) BSIG do not apply to operators of public telecommunications networks and providers of publicly available telecommunications services. The only exception is further activities that fall under a type of entity in Annex 1 or 2 of the BSI Act. For telecom providers, the main offence left from the BSI Act is the one on registration.

How does the Bundesnetzagentur enforce the duties?

With orders, which it can enforce with periodic penalty payments if necessary. For Part 10 Chapter 1 of the TKG (Sections 164 to 183, which includes Sections 165 to 174), Section 183 TKG is the specific power, alongside the special powers in Sections 165 and 166 and the general powers in Sections 202 to 204.

The sources do not say which legal basis the BNetzA chooses for the duties under Sections 165 to 174 in a given case. In our reading, Section 183 takes precedence as the more specific provision.

Section 174 shows the difference between a fine and enforcement: the secured interface under subsection 7 and the duty to transmit under subsection 6 sentence 1 are not subject to a fine, while confidentiality under subsection 6 sentence 2 is. For repeated breaches of subsection 6, the BNetzA can freeze the customer base. For the interface under subsection 7, orders with periodic penalty payments remain, with a prohibition as the last resort.

Fine or periodic penalty payment: what is the difference?

In our understanding, a fine sanctions a breach that has already happened, such as a late report. A periodic penalty payment is meant to enforce an order that has not yet been complied with. The TKG provides for both side by side. The periodic penalty payment is set under the Administrative Enforcement Act (Verwaltungsvollstreckungsgesetz, VwVG), which we have not analysed for this page.

Example: overview for a VoIP provider

Fictitious example, not a client. A VoIP provider without its own network has 30 employees and 8,000 subscribers. It assigns telephone numbers and sells its telephony to business customers. Its compliance officer sets up an overview that links each duty to the offence, the maximum amount and the internal evidence. The mapping is our reading of the wording.

The overview helps to prioritise the evidence. It is no assessment of whether, or in what amount, the authority would impose a fine in a specific case.

Three typical gaps

Documenting your duties properly

We help you set up the security concept, reporting procedures and evidence so that they are complete when the Bundesnetzagentur reviews them. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur. Our services are summarised on telecom security under the TKG.