The European General Data Protection Regulation (GDPR)
Entered into force on May 25, 2016, and has applied directly in all European Union Member States since May 25, 2018, without requiring implementation into national law.
The German Federal Data Protection Act (BDSG), which entered into force on May 25, 2018,
Together with the data protection laws of the federal state and other sector-specific data protection rules, supplements the processing of personal data in cases where the GDPR has given Member States national regulatory discretion through so-called “opening clauses.”
The Telecommunications Digital Services Data Protection Act (TDDDG)
Entered into force on December 01, 2021 and, in particular, governs the confidentiality of telecommunications, data protection in telecommunications and telemedia services, and the requirements for setting cookies.
Applicable data protection rules can also be found at
- Telecommunications Act (TKG)
The TKG provides the framework for telecommunications networks and services. It regulates the telecommunications market and, among other things, promotes the protection of the public and customers. - Telecommunications Interception Ordinance (TKÜV)
The TKÜV builds on the TKG and sets out specific obligations for the technical and organizational implementation of telecommunications surveillance measures.
Within the Deutsche Telekom AG Group, data protection and data security are governed by
- the Binding Corporate Rules Privacy (BCRP)
The BCRP form the Group-wide internal policy on data protection. To the extent legally permissible, the companies of the Deutsche Telekom Group have committed to this Group policy. The BCRP are intended to ensure a consistently high level of data protection for our products and services. A list of the companies that have formally adopted this Group policy is available alongside under "More information". - the Group Policy on the Organization of Data Privacy
This policy defines the governance and implementation functions for data protection in the German Group companies. It establishes roles for assuming responsibility for data processing within the Group companies. You can learn more about these roles and functions in the article on the "data protection organization." - the Group Policy on Security
The Group Policy on Security sets out the Group's key security principles.
These Group Policies establish binding standards aligned with the international ISO 27001 standard to ensure an appropriately high and consistent level of security and data protection throughout the Group.
The General Data Protection Regulation provides that personal data may be processed in a country outside the European Union (in so-called third countries), particularly where appropriate safeguards ensure an adequate level of protection. The Deutsche Telekom Group uses the Standard Contractual Clauses recognized by the European Commission as such a safeguard or, for data transfers within the Group, the Binding Corporate Rules Privacy.
