Secrecy of telecommunications under Section 3 TDDDG: who is bound and how to protect it

Legal status: Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) as amended on 10 March 2026, German Telecommunications Act (TKG) as amended on 22 October 2026, German Criminal Code (Strafgesetzbuch, StGB) as amended on 20 March 2026, checked on 6 November 2026. This page explains the secrecy of telecommunications for telecom providers and shows how to put it into practice in your organisation. It is general information, not legal advice. Individual data protection questions, for example on storing traffic data, and questions of criminal law are for a lawyer admitted in Germany. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.

What does the secrecy of telecommunications protect?

The content of telecommunications and its detailed circumstances. Section 3(1) TDDDG reads: “The content of telecommunications and its detailed circumstances, in particular the fact whether someone is or was involved in a telecommunications process, are subject to the secrecy of telecommunications. The secrecy of telecommunications also extends to the detailed circumstances of unsuccessful connection attempts.” (unofficial translation)

So what is protected is not only what is said or transmitted. Even the information that a particular line had or attempted a connection at a particular time is covered. In our reading, the detailed circumstances in operations include, for example, phone numbers and the times and duration of connections. Section 206(5) StGB describes the secrecy of telecommunications in the same words.

For the secrecy of telecommunications, the catalogue of security requirements 2.0 of 29 April 2020 still refers to Section 88 of the 2004 version of the TKG. The rule in force is Section 3 TDDDG.

Who is bound by the secrecy of telecommunications?

Four groups, each together with everyone who contributes to providing the services. Section 3(2) sentence 1 TDDDG lists them. The examples in the third column are our classification:

Under Section 3(2) sentence 2, the duty continues after the end of the activity that gave rise to it. Anyone who leaves therefore remains bound. Unlike the security duties under Section 165(2) and Sections 166 and 168 TKG, the secrecy of telecommunications under nos. 2 and 4 does not require a publicly available service. Whether you are a telecom provider at all is explained on the page Am I a telecom provider?.

What may technical staff and customer service know?

Only as much as is necessary for the service and operations. Section 3(3) TDDDG prohibits those obliged from obtaining, for themselves or others, knowledge of the content or the detailed circumstances beyond what is necessary for providing the telecommunications services or operating their networks or installations, “including the protection of their technical systems” (unofficial translation). Three rules follow from this:

• Necessity: knowledge only to the extent required, for the service, operations and protection of the systems.
• Purpose limitation: the knowledge may only be used for this purpose.
• Disclosure only by law: use for other purposes, in particular disclosure to others, is permitted only where the TDDDG or another statutory provision provides for it and expressly refers to telecommunications processes. The duty to report under Section 138 StGB takes precedence.

For typical situations in operations, this looks as follows in our reading. The table does not replace an assessment of the individual case:

When a telecom provider must cooperate in interception measures and information requests is governed separately in the TKG, see cooperation under Section 170 TKG and customer data and information procedures. How long traffic data may be stored and for what it may be used is governed by further provisions of the TDDDG, which this page does not cover.

How does Section 3 TDDDG relate to Section 165(1) TKG?

Section 3 TDDDG governs conduct, Section 165(1) TKG governs protection through technology and organisation. In our classification, the two complement each other: the TDDDG prohibits listening in and passing on. Section 165(1) TKG requires everyone who provides telecommunications services or contributes to them to take appropriate technical precautions and other measures to protect the secrecy of telecommunications and against breaches of the protection of personal data, taking the state of the art into account. Section 165(1) does not require a publicly available service either.

Anyone who operates a public telecommunications network or provides publicly available telecommunications services describes these measures in the security concept. Catalogue 2.0, which is in force, deals with the secrecy of telecommunications and data protection in chapter 4, and the draft version 2025-10 in a separate area 4.1 “Protection of the secrecy of telecommunications and personal data”. The draft has not been adopted (as of 6 November 2026). The other protective measures are explained on the page protective measures under Section 165 TKG, the catalogue on the page catalogue of security requirements.

What role does Section 206 StGB play?

It makes unauthorised disclosure a criminal offence. Under Section 206(1) StGB, anyone who, as the owner or an employee of a company that provides postal or telecommunications services on a commercial basis, without authorisation discloses to another person facts that are subject to the secrecy of telecommunications and that became known to them in that capacity is liable to imprisonment of up to five years or a fine. The same penalty applies to anyone who, as owner or employee, permits or facilitates such a disclosure (subsection 2 no. 3). This summary of the wording is our own unofficial translation.

Subsection 3 extends criminal liability to persons who supervise such a company, who are entrusted by it or with its authorisation with providing telecommunications services, or who are entrusted with producing an installation for its operation or with work on it. In our reading, this also covers service providers in on-call service and maintenance. Whether a disclosure was unauthorised depends on the individual case. For operations, this means that employees and service providers should know what they may and may not do.

How do you put the secrecy of telecommunications into practice?

With clear rules that everyone involved knows and has confirmed. Section 3 TDDDG does not prescribe a particular form. We recommend five building blocks:

1. Commitment of employees: Every person with access to the network, the platform, customer systems or connection data confirms in writing on joining that they have been instructed on Section 3 TDDDG and Section 206 StGB. The instruction is repeated when their role changes.
2. Commitment of service providers: The contract contains a clause on protecting the secrecy of telecommunications. The service provider commits the persons it deploys and keeps a list that you can request. More on service providers in the network: supply chain in telecom networks.
3. Permissions based on necessity: Who may see connection data, signalling or recordings follows from the task. Access is logged and reviewed regularly. In more depth: access to network elements.
4. Rule for requests from third parties and authorities: A named office receives requests and checks the legal basis. Technical staff and customer service give no information over the phone.
5. Training: Technical staff and customer service are trained annually, with examples from your own operations. Attendance is documented.

Example: commitment at a VoIP provider

Fictitious example, not a client. A VoIP provider with 30 employees runs a telephony platform for business customers in a rented data centre. It has outsourced on-call service at night and at weekends to a service provider, and six people work in customer service. It is a provider of a publicly available telecommunications service and therefore bound under Section 3(2) sentence 1 no. 1 TDDDG. Both tables are our suggestion, and all details are invented.

Confidentiality declaration (for employees, one copy per person):

Commitment overview (kept by the security officer):

The overview shows at a glance where a commitment is missing. It is part of the evidence for the security concept under Section 166 TKG.

Three typical gaps

How we help

We set up confidentiality declarations, contract clauses for service providers, the permissions concept and training on the secrecy of telecommunications and integrate them into your security concept. We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur (BNetzA), the German Federal Network Agency. Whether a particular processing of traffic data is permitted under data protection law is a question for your data protection officer or a lawyer admitted in Germany. What has to be notified after a personal data breach is set out on the page data breach notification under Section 169 TKG.