VoIP and cloud telephony without your own network: which TKG duties apply

Legal status: German Telecommunications Act (Telekommunikationsgesetz, TKG) and BSI Act (BSI-Gesetz, BSIG), each as amended on 22 October 2026, Telecommunications Interception Ordinance (TKÜV) as amended on 22 October 2026, checked on 6 November 2026. This page provides general information, not legal advice. Which duties apply to your company in a specific case is a question for a lawyer admitted in Germany. Whether you provide the service yourself or only contribute to it, for example as a reseller, can be checked on the page am I a telecom provider?. Providers based abroad that offer telephony to customers in Germany will find what else applies to them on the page for telecom providers based abroad. Quotations from German statutes on this page are our own unofficial translations. Only the German text is legally binding.

Which TKG duties apply to service providers without their own network?

Most security duties apply unchanged, some only to network operators. The table lists them in the order in which we would tackle them.

The general ruling on the catalogue of security requirements under Section 167 TKG (in force: version 2.0 of 29 April 2020) is addressed to all service providers and operators. Chapter 3 applies to everyone, annex 1 additionally to providers with their own IP infrastructure. If you run your own platform, you should therefore check whether annex 1 applies to you.

Does the security concept have to be submitted to the Bundesnetzagentur?

Only if the BNetzA asks for it. Section 166(2) sentence 2 TKG provides that anyone who provides publicly available telecommunications services may be required by the Bundesnetzagentur to submit the security concept. You still have to draw it up, together with the implementation declaration stating that the measures have been implemented or will be implemented without undue delay (Section 166(1) no. 3 and (3)).

We recommend keeping the concept in a state in which it can be submitted at any time. An order to submit it is enforceable, and failing to comply is an administrative offence (Section 228(2) no. 3(c) TKG). After a submission, the duty to adapt the concept when circumstances change and to submit it again (Section 166(4) sentence 2) also applies, because it is addressed to the person “obliged under subsection 2” (in our reading). Structure and content of the concept are covered on the page security concept under Section 166 TKG.

What do emergency calls under Section 164 TKG require?

Anyone who offers publicly available number-based telephony for outgoing calls to telephone numbers must enable emergency calls to 110 and 112 free of charge (Section 164(1) sentence 1). The essentials:

• The emergency call transmits the number of the line and the data needed to determine the caller's location (subsection 1 sentence 3).
• Emergency calls take priority over other calls (subsection 1 sentence 4).
• Each provider bears its own costs for emergency calls (subsection 1 sentence 7).
• Number-independent services such as messaging only have to transmit location data if they allow a direct connection to the emergency call centre (subsection 4).
• Details are set out in the Emergency Call Ordinance (NotrufV) and a technical guideline of the BNetzA, whose requirements must be met no later than one year after publication (subsection 6).

We do not describe the content of the NotrufV and the technical guideline here. For cloud telephony a separate check is worthwhile: if customers use their number in changing places, for example when working from home or with a softphone app on the move, the registered line address does not always match the caller's location. How location data is to be determined in this case should be clarified against the NotrufV and the technical guideline. If the platform comes from an upstream provider, emergency call routing belongs in the contract. In our reading, responsibility stays with whoever provides the service to the customer.

What applies to security incidents?

The same reporting duty as for network operators, with no size threshold: significant security incidents are reported to the BNetzA and the BSI, with an early warning no later than 24 hours after becoming aware, a notification after 72 hours and a final report one month later (Section 168(1)). In cloud telephony, part of the technology often sits with third parties: the data centre, the carrier for interconnection, the platform vendor. According to the BNetzA reporting concept, whoever uses third parties remains responsible, and organisational shortcomings that delay the report count against the provider obliged to report. Service providers should therefore be contractually required to pass on incidents immediately.

Customer data and interception in outline

Providers that assign telephone numbers collect the customer data under Section 172 before activation. Under the Customer Data Information Ordinance (KDAV), databases for the automated retrieval procedure under Section 173 are needed only above 10,000 subscribers. Anyone who provides telecom services on a business basis or contributes to them answers individual requests (Section 174(6)), and below 100,000 contract partners the e-mail procedure is enough. Process and thresholds are covered on the page customer data under Sections 172-174 TKG.

For interception under Section 170 TKG, in our reading anyone who runs their own telephony platform is an operator of an installation under subsection 1, even in a rented data centre, because Section 3 no. 60 TKG also counts servers as telecommunications installations. Anyone who uses a third party's installation falls under subsection 2, and the 10,000 threshold of the TKÜV applies neither to network nodes that route voice services abroad nor to information requests on traffic data. Duties, thresholds and organisation are explained on the page Section 170 TKG and the TKÜV.

Example: duty sheet for a cloud telephony provider

Fictitious example, not a client. A provider with 18 employees sells cloud telephony to business customers across Germany. It assigns numbers from its own blocks, runs a softswitch and session border controllers in a rented data centre and interconnects with the public telephone network through a carrier. It has around 4,500 subscribers and 700 contract partners, many of them using softphones while working from home. The platform itself routes calls abroad.

The sheet is our classification based on the wording of the statute, not a review of an individual case. You can reuse the columns and rows and add "status" and "next review".

The Section 170 row shows why the detail matters: without the routing abroad, the 10,000 threshold would apply here.

Three common gaps

How we can help

We draw up and revise security concepts under Section 166 TKG for providers without their own network as well, so that they can be submitted when requested, and we set up the reporting procedure and evidence. Where you stand today is shown by the status review (stage 1). We have acted as security officers under Section 166 TKG and have drawn up and updated security concepts and agreed them with the Bundesnetzagentur.