IT Law

Home › IT law

IT law in Germany is not a single code. It is the interplay of contract law, copyright, data protection, IT security law and a growing number of EU regulations. We advise software houses, IT service providers, users in industry and the Mittelstand, and public-sector buyers. This page gives an overview of our topics, each with a link to a more detailed page.

Michael Horak, LL.M., a lawyer and qualified electrical engineer (Dipl.-Ing.), has practised IT and telecoms law for more than 30 years. Our team includes specialist lawyers (Fachanwälte) for intellectual property and for copyright and media law, and one lawyer who is also a physicist. Technical facts do not have to be translated for us first.

IT contracts: software, SaaS, cloud and outsourcing

Most IT law matters begin or end with a contract. Under German law the key question is which type of contract applies: sale, contract for work (Werkvertrag), contract for services or lease. Acceptance, warranty rights, limitation and termination all depend on it. Since 2022, sections 327 et seq. of the German Civil Code (BGB) have added rules for digital products supplied to consumers, including a duty to provide updates.

• Software, SaaS and cloud contracts
• IT projects in crisis
• IT outsourcing (in German)
• Open source and licence compliance (in German)
• Agile IT projects (in German)
• EVB-IT and public IT procurement (in German)
• Tech transactions and IT due diligence (in German)

Internet law, e-commerce and platforms

If you sell online or run a platform, distance selling rules, price indications, accessibility and the Digital Services Act have to be considered together. Since 19 June 2026 this also includes the electronic withdrawal function under section 356a BGB for distance contracts concluded via an online interface.

• E-commerce and online shops
• Platforms and the DSA
• Digital products (sections 327 et seq. BGB) (in German)
• Accessibility (BFSG) (in German)
• Domain law (in German)

Data protection and data

Data protection is part of almost every IT project: processing agreements under Art. 28 GDPR, transfers to third countries, cookies under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) and notifying data breaches within 72 hours. The Data Act adds access rights to non-personal device data.

• Data protection
• Reporting a data breach
• Data Act
• Trade secrets (in German)
• IT compliance (in German)

IT security and regulation

The German NIS2 Implementation Act has applied since 6 December 2025. It requires considerably more companies to manage risks, register with the Federal Office for Information Security (BSI) and report significant security incidents. Since 11 September 2026, manufacturers of products with digital elements have had to report actively exploited vulnerabilities under the Cyber Resilience Act.

• IT security law
• Cyber attack: immediate steps
• NIS2 (in German)
• Cyber Resilience Act (in German)
• DORA (in German)

Blockchain, IP and media law online

We also advise on blockchain, smart contracts, tokenisation and MiCA, and on copyright, trade marks, unfair competition and personality rights online, for example in our pages on Fintech and MiCA (in German), copyright (in German) and online attacks on your reputation.

AI law, covering the AI Act, AI contracts and copyright in AI training, has its own section: AI law.

How we work on IT law matters

1. First call: we clarify the facts, your objective and the time pressure. For urgent matters such as interim injunctions or data breaches, on the same day.
2. Documents: contracts, specifications, tickets, minutes and correspondence. For projects, also change requests and acceptance records.
3. Assessment: we classify the type of contract, review claims, deadlines and evidence, and set out the cost risk and your options.
4. Action: drafting, negotiation, out-of-court settlement, mediation, arbitration or litigation.

FAQs on IT law in Germany

When do I need an IT lawyer?

Typical occasions are a new software or cloud contract, a failed IT project, a warning letter over a licence breach, a data breach, or the question whether NIS2, the Data Act or the AI Act applies to your business. The earlier you involve us, the more can be settled in the contract.

Do you advise across Germany?

Yes. In addition to our head office in Hanover, we have offices in Berlin, Bielefeld, Bremen, Düsseldorf, Frankfurt (Eschborn), Hamburg, Leipzig, Munich and Stuttgart. We handle many matters by video call.

How are IT disputes decided?

Before the civil courts, often with an expert opinion. For technically complex disputes, mediation (in German) or arbitration may also be options.