Technology, Media and Telecoms

Technology and media in Germany: the regulatory landscape

Technology and media companies in Germany operate under one of the densest regulatory frameworks in the world. EU law sets most of the rules: the GDPR for personal data, the Data Act for data from connected products and cloud switching, the AI Act for artificial intelligence, the Digital Services Act and Digital Markets Act for platforms, the NIS2 Directive and the Cyber Resilience Act for cybersecurity.

Germany adds its own layers: the Telecommunications Act (Telekommunikationsgesetz, TKG), the Digital Services Act implementation act (DDG), the Federal Office for Information Security Act (BSIG), state media law and a copyright law that is strongly protective of authors. For technology and media businesses of every kind, from software and SaaS providers to semiconductor and hardware companies, data centre operators, telecoms operators, platforms, publishers and broadcasters, compliance is a strategic issue and a condition for market access.

This page gives an overview of the legal issues for technology and media companies in Germany and links to our detailed pages in the data protection, IT and digital practice and to related insights. It is part of our sectors coverage.

Software, SaaS and IT contracts

Contracts for software, SaaS, cloud services, IT projects and outsourcing are the commercial backbone of the technology sector. German law has no specific code for IT contracts; courts classify them under the categories of the Civil Code. Software licences on a permanent basis are often treated like sales, SaaS subscriptions like rental contracts, and custom development projects as contracts for work, with acceptance as the decisive event for warranty and payment. The classification determines warranty rights, termination and liability. Provider terms are usually standard terms and are reviewed under § 307 BGB even between businesses, so liability caps and exclusions of warranty must be drafted with care.

Agile projects require contracts that combine flexibility with clear responsibilities for product ownership, sprint acceptance and budget control. Outsourcing in regulated sectors, such as banking and insurance, is subject to supervisory requirements and, for financial entities, the Digital Operational Resilience Act (DORA). Under the Data Act, cloud and other data processing services must enable customers to switch providers, and switching charges are being phased out completely from 12 January 2027. See our insights on SaaS and cloud contracts and IT contracts for agile projects.

Open source and IP in software

Software is protected by copyright, and rights in software created by employees vest in the employer for economic exploitation by statute. Open-source components are found in almost all commercial software; their licences, from permissive to strong copyleft, impose obligations on distribution and sometimes on network use. An open-source compliance process and documented software bills of materials, which the Cyber Resilience Act now effectively requires, are essential for licensing, M&A and product security. See our insight on open-source compliance.

Data protection, AI and the Data Act

Technology companies process personal data at scale and are a focus of the German data protection authorities. The GDPR applies alongside the Federal Data Protection Act and the Telecommunications Digital Services Data Protection Act (TDDDG), which governs cookies and similar technologies. International data transfers to the United States can rely on the EU-US Data Privacy Framework for certified recipients, while transfers elsewhere need standard contractual clauses and transfer impact assessments. See our page on GDPR and German data protection law.

The AI Act regulates AI systems by risk. Prohibited practices and the AI literacy obligation have applied since 2 February 2025 and the rules for general-purpose AI models since 2 August 2025. Following Regulation (EU) 2026/1744, obligations for high-risk AI systems apply from 2 December 2027 for Annex III use cases and from 2 August 2028 for AI in products covered by Annex I, and new prohibitions apply from 2 December 2026.

Germany's AI Market Surveillance and Innovation Act (KI-MIG) designated the Federal Network Agency as the main market surveillance authority. The Data Act gives users of connected products access to their data and regulates data sharing contracts; Germany's implementing act (DADG) made the Federal Network Agency the competent authority, with fines of up to EUR 5 million or 2% of turnover. See our pages on the EU AI Act and the EU Data Act.

Platforms, digital services and competition

Online platforms and marketplaces are regulated by the Digital Services Act, which has applied in full since 17 February 2024. Obligations are tiered from intermediary services to hosting services, online platforms, marketplaces and very large online platforms and search engines. Hosting services need notice-and-action procedures and must give reasons for content moderation decisions; marketplaces must verify traders and design their interfaces to allow compliance with consumer law.

In Germany, the Federal Network Agency acts as Digital Services Coordinator under the DDG. The European Commission enforces the DSA against very large platforms and imposed its first non-compliance fine, EUR 120 million on X, on 5 December 2025. See our page on digital platforms, the DSA and the DMA.

Competition law adds special rules for large digital companies. The Digital Markets Act imposes obligations on designated gatekeepers, and § 19a of the Act against Restraints of Competition allows the Federal Cartel Office to designate companies of paramount significance for competition across markets and prohibit certain practices; it has used this power against several large technology companies. Acquisitions of start-ups with low turnover can be caught by the German transaction value threshold. See our insight on digital gatekeepers under § 19a GWB.

Telecoms, data centres and semiconductors

Operators of public telecommunications networks and providers of most publicly available telecoms services must notify the Federal Network Agency (§ 5 TKG). The TKG regulates access to the networks of operators with significant market power, consumer protection, including a maximum initial contract term of 24 months for consumer contracts, rights of way and the coordination of civil works, and a right to a minimum level of fast internet.

The laying of telecoms lines for public networks is in the overriding public interest until 31 December 2030 (§ 1(1) TKG). Spectrum is allocated by the Federal Network Agency, usually through auctions or, more recently, through extensions of existing assignments combined with coverage obligations. The Commission proposed a Digital Networks Act in 2026 that would reshape EU telecoms regulation. See our insight on telecommunications regulation under the TKG.

Data centres are subject to the Energy Efficiency Act, which sets requirements on power usage effectiveness, waste heat reuse and renewable electricity, and depend on grid connection capacity; operators may also be covered by the BSIG and the KRITIS umbrella act on physical resilience. Semiconductor projects are supported under the EU Chips Act framework and state aid rules, and both semiconductors and their production equipment are subject to export controls and investment screening. See our insights on data centres and semiconductors and the EU Chips Act.

Cybersecurity

The new BSIG, implementing the NIS2 Directive, has applied since 6 December 2025 and covers many technology companies, including providers of cloud computing, data centre, content delivery, managed IT and managed security services, depending on size. Covered entities must implement risk management measures, report significant incidents in stages, and register with the Federal Office for Information Security; management bodies must approve and supervise the measures and can be held liable. See our page on cybersecurity: NIS2, BSIG and the CRA.

Public sector technology contracts

Public authorities are major buyers of software, cloud services and IT projects. Contracts above the EU thresholds must be tendered under procurement law, and authorities frequently use the supplementary terms for the procurement of IT services (EVB-IT), which contain their own rules on liability, acceptance and rights of use. Digital sovereignty requirements, data localisation preferences and security clearance requirements for personnel can apply, particularly for cloud services used by federal authorities. Technology and media suppliers bidding for public contracts should review these standard terms early, because deviations are often limited and bids with conflicting terms may be excluded.

Media, content and copyright

Media regulation in Germany is largely a matter for the federal states. The Interstate Media Treaty governs broadcasting, telemedia with journalistic content, media platforms and intermediaries, and is enforced by the state media authorities. Press law, personality rights and the right to one's own image shape reporting, and German courts grant preliminary injunctions against publications quickly. Youth protection rules apply to online content and games, and providers must implement age verification or labelling systems that meet the requirements of the Commission for the Protection of Minors in the Media.

Copyright lasts until 70 years after the author's death and cannot be transferred as such, only licensed; unclear licences are interpreted narrowly according to their purpose, so content and technology contracts should list licensed uses expressly. Upload platforms are directly liable for user content under the Copyright Service Provider Act unless they meet licensing and blocking duties. The use of protected works for training AI models raises questions under the text and data mining exceptions, which rights holders can reserve. See our insights on copyright and media law and text and data mining for AI training.

Technology and media transactions and investment

Technology M&A and venture capital investment require specific due diligence: ownership of IP and source code, open-source compliance, data protection and data rights, cybersecurity incidents, key customer contracts and their change-of-control clauses, and regulatory status under the AI Act, the DSA or the TKG. Employee participation programmes, often virtual share programmes, need to be addressed in the transaction. Acquisitions by investors from outside the EU in critical technologies such as AI, semiconductors, cybersecurity, quantum and telecoms infrastructure can trigger investment screening with lower thresholds. See our pages on venture capital and start-ups and foreign investment control.

Disputes in the sector include IT project failures, licence and SaaS disputes, patent disputes over standard-essential patents, often before German courts and the Unified Patent Court, and copyright and media law proceedings. Trade secrets can be protected in court proceedings through confidentiality orders.

Employment issues in technology and media

Technology and media companies compete for scarce talent and often work with freelancers, remote employees abroad and international teams. Freelance arrangements must be checked for false self-employment, because the German pension insurance authority looks at actual integration into the client's organisation rather than the contract label, and back payments of social security contributions can be substantial. Works councils have co-determination rights on technical devices suitable for monitoring employees' performance or behaviour (§ 87(1) no. 6 BetrVG), which covers most collaboration, ticketing and AI tools. Introducing such tools without a works agreement can be stopped by injunction. See our insight on AI tools and works council rights.

Consumer law for digital services

Consumer-facing technology and media companies must comply with German and EU consumer law for digital content and services: pre-contractual information, the right of withdrawal and its early expiry for digital content with the consumer's consent, the cancellation button for subscriptions, the electronic withdrawal function required since 19 June 2026, and update obligations for digital products.

Advertising, including influencer marketing and in-game purchases, is reviewed under the Act against Unfair Competition, and enforcement by competitors and consumer associations is frequent. The Commission's proposal for a Digital Fairness Act, adopted on 11 November 2026, targets dark patterns, addictive design and personalised pricing and will shape product design for technology and media businesses in the coming years.

How TRW & Co helps

We advise software and SaaS companies, hardware and semiconductor companies, data centre and telecoms operators, platforms and media companies, and investors in technology and media. We draft and negotiate IT, SaaS, cloud, outsourcing, licence and content agreements, and advise on data protection, the AI Act, the Data Act, the DSA, cybersecurity and telecoms regulation. We support technology M&A and venture capital transactions, including IP and regulatory due diligence and investment screening, and represent clients in IT, copyright, media and technology disputes. To discuss your matter, please contact us. This page provides general information, not legal advice.