Significant security incidents under the German Telecommunications Act (TKG): deadlines and procedure

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) as amended on 22 October 2026, checked on 6 November 2026. Section 168 has applied in its NIS2 version since 6 December 2025, without a transition period. This page provides general information, not legal advice. Whether a specific incident must be reported is assessed by the provider. Legal questions about your case are a matter for a lawyer admitted in Germany.

When is a security incident significant?

Under Section 168(3) TKG an incident is significant if it has caused or can cause severe operational disruption or financial loss for the provider, or if it has affected or can affect other natural or legal persons by causing considerable material or non-material damage. The possibility of such damage is enough.

A security incident is any event that compromises the availability, authenticity, integrity or confidentiality of data or services (Section 3 no. 53 TKG). The TKG includes authenticity, which the definition in the German BSI Act leaves out. Because the definition covers any event, in our reading an outage without an attacker can also qualify.

The Bundesnetzagentur gives indicators in its reporting concept for when it considers an incident significant. These are thresholds set by the authority, not by the statute:

• more than 1 million affected user hours (affected users multiplied by duration in hours),
• any incident at international interconnection points,
• any incident affecting emergency call routing, meaning the dedicated hardware and software used for it, not a single customer line.

The BNetzA stresses that the list is not exhaustive, that each provider assesses incidents on its own responsibility and that voluntary reports are welcome. For a small provider this means, in our assessment, that the user-hours threshold is rarely reached, so the assessment against the two statutory criteria still has to be made.

Who reports, and to whom?

Every operator of a public telecommunications network and every provider of publicly available telecommunications services, regardless of size and of the classification under the BSI Act. According to the BNetzA, providers of number-independent services such as messaging have also been covered since the TKG 2021. Reports always go to both authorities: the Bundesnetzagentur and the BSI.

The reporting duty under Section 32 of the BSI Act does not apply to telecom providers (Section 28(5) BSIG). They report under Section 168 TKG instead, unless further activities fall under the BSI Act, as explained on NIS2 for telecom providers in Germany. Providers based abroad that serve customers in Germany report through the same channels. What else applies to them is set out on the page for telecom providers based outside Germany.

Which report is due when?

Section 168(1) and (2) provide for up to five reports. Deadlines run from the moment the provider becomes aware of the significant incident:

Where possible, the BNetzA acknowledges receipt within 24 hours of the early warning. On request, the BSI can provide technical support and advice on mitigation, and the BNetzA can ask for a detailed report. The provisions of the Federal Data Protection Act protecting against self-incrimination apply accordingly (Section 168(1) sentence 2 TKG). Separately, where there is a particular and significant threat, providers must inform potentially affected users of possible protective measures and, where appropriate, of the threat itself (Section 168(7)).

How to report in practice: the BNetzA reporting concept and form

The BNetzA sets the details of the procedure (Section 168(4)) and has published a reporting concept and a reporting form (in German). Its website describes both as drafts. Reports are sent with the form by e-mail to the BNetzA (sicherheitsvorfall.tkg@bnetza.de) and to the BSI (Meldungen-tkg@bsi.bund.de) or by fax, and by post only where there is no urgency. The BNetzA recommends encrypting the e-mail with PGP.

Three points from the reporting concept matter for your organisation. If in doubt, containing the immediate effects comes before the report. A provider that uses third parties to detect incidents, such as an on-call contractor, remains responsible. And organisational shortcomings that delay a report count against the provider.

Where the BNetzA documents differ from the statute

The reporting concept and form predate the current Section 168 or were only partly updated. The statutory text prevails. In detail:

How Section 168 differs from Section 169 TKG

Section 169 sets a separate route for personal data breaches: providers of publicly available services notify the BNetzA and the Federal Commissioner for Data Protection and Freedom of Information (BfDI), not the BSI, without undue delay and, under Regulation (EU) 611/2013, where feasible within 24 hours of detection. An attack on customer data can trigger both duties, and the reports under Sections 168 and 169 then run in parallel. Deadlines, notifying the persons affected, the breach inventory and how this differs from Article 33 GDPR are covered on the page notifying personal data breaches under Section 169 TKG.

Internal reporting procedure: who does what?

The deadlines are short and often fall on evenings and weekends. A reporting procedure works only if it is settled in advance who assesses, who approves and who sends. The following split of roles is our recommendation for small and mid-sized providers. The statute does not prescribe it.

Exercise script: voice platform outage on a Friday evening

Example, not a client. A VoIP provider with 30 employees runs a voice platform for business customers with around 9,000 numbers. It provides a publicly available telecommunications service and therefore reports under Section 168. The script works for a two-hour tabletop exercise. We count the deadlines cautiously from the first concrete suspicion. When awareness exists in the legal sense has to be assessed case by case.

Questions for the exercise: who approves at 19:00 on Friday if management cannot be reached? Are the form, recipient addresses and PGP keys at hand? Who decides whether customers are told about the threat? Where do the user numbers for the assessment come from?

Roles, deadlines, a deadline calculator, an incident log and this script are available as an Excel template (in German) for the internal reporting procedure on the page templates for telecom providers.

Three common gaps

How incident handling fits with the other safeguards is explained under protective measures under Section 165 TKG. If you want your reporting procedure reviewed or an exercise prepared, get in touch. A structured starting point is the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.