DATA RETENTION
Data Retention, Quick Freeze and IP Address Retention
Answer subscriber requests in seconds, prepare for Germany’s planned quick freeze and IP address retention, and keep a complete audit trail for every step.
Data retention is the secure storage, retrieval and audit of telecommunications data that providers must keep, preserve or disclose under law. ICS data retention solutions cover subscriber data requests, Germany’s planned quick freeze and IP address retention, with chain-of-custody and audit trails throughout. They integrate with ICS lawful interception platforms.
עובדות עיקריות
- Subscriber Data Warehouse: answers subscriber requests from authorities in seconds instead of hours.
- On your premises: deployed on your infrastructure, so data never leaves your network.
- Quick freeze (§ 176 TKG-E): traffic data including location, no content, for up to three months plus up to three months by court order.
- שמירת כתובות IP (§ 177 TKG-E): internet access providers store IP assignments for three months in a separated store.
- העברה: retained data follows ETSI TS 102 657.
- Legal status: §§ 175-177 TKG-E are a government draft (BT-Drs. 21/6581) and may still change.
What does data retention mean for German providers?
Today, providers answer subscriber data requests under § 174 לחוק התקשורת (TKG) and traffic data requests from authorities. Since 18 August 2026, European Production and Preservation Orders under the e-Evidence Regulation apply as well.
The government draft adds two new instruments. Quick freeze lets authorities preserve existing traffic data by individual order. IP address retention obliges internet access providers to store IP assignments for all connections. Every request type needs fast, complete, confidential and logged answers.
Legal status
Quick freeze (§ 176 TKG-E) and IP address retention (§ 177 TKG-E) are part of the government draft BT-Drs. 21/6581. The bill had its first reading in the Bundestag on 24 June 2026 and is now in committee. Details may change, and ICS updates its services as the text evolves.
How does the Subscriber Data Warehouse speed up requests?
Subscriber data is often spread across silos: billing, provisioning, CRM and legacy systems. Searching each one by hand takes hours. The ICS Subscriber Data Warehouse brings the data together without replacing your systems.
- Custom ETL pipelines: extract data without migration, normalize phone numbers and addresses, and load everything into one indexed warehouse.
- Fast full-text search: find subscribers in any phone number format.
- Incremental sync: changes arrive within minutes.
- Every search logged: a full audit trail for each request.
- API תואם ETSI: connects to your request handling.
The warehouse runs on your infrastructure with no cloud dependencies. It is built on open-source components with full audit logging, and you own the data.
How is the warehouse rolled out?
1
Discovery
ICS maps your data sources, formats and request process.
2
Build
The team develops the ETL pipelines and the search index.
3
Deploy
The warehouse is installed in your infrastructure. Data never leaves your network.
4
Train
Your staff learn to search, answer and document requests.
How does ICS handle quick freeze orders?
A quick freeze order (Sicherungsanordnung) obliges providers to preserve traffic data without delay. The draft bases the order on § 100g StPO and sets the provider duties in § 176 TKG-E. This includes location and cell data, but no content. An order is valid for up to three months, and a court can extend it by up to three months.
Frozen data must be stored separately and securely. It may only be disclosed on a separate request, and must then be deleted irreversibly. The draft covers around 3,000 providers and also applies to those who participate in providing the services. ICS can therefore act as your service provider for the freeze process (Erfüllungsgehilfe), while you remain the obligated party.
Quick freeze service
01
Order intake
ICS receives orders, checks them formally, tracks deadlines and manages court extensions.
02
Extraction connectors
Connectors to mediation, CDR, session and accounting systems extract the relevant traffic data.
03
Encrypted freeze vault
Each order gets its own encrypted container, separated from all other data, with controlled access.
04
Disclosure via ESB
Frozen data is handed over only on a separate request, through the electronic interface (ESB).
05
Logged deletion
Deletion is irreversible and logged, and you receive a deletion certificate.
06
BNetzA documentation and billing
ICS prepares the documentation for the BNetzA and handles JVEG compensation billing.
What does IP address retention require?
Under § 177 TKG-E, providers of internet access services must store, for three months:
- the public IP address, or for IPv6 the assigned prefix,
- port numbers where needed for attribution, for example behind carrier-grade NAT (CGNAT),
- the line identifier and user identifier,
- start and end of each assignment, to the second, with time zone.
The data must sit in a separated store. It may only be used to identify subscribers under § 174 TKG and for e-Evidence subscriber requests. Providers have six months after entry into force to comply.
RADIUS accounting covers most fields, but not CGNAT port mappings, so NAT logging is needed. MVNOs and resellers must ensure storage even when the IP address is assigned by the host network (§ 177 (2) TKG-E). They can do this by contract or through a data feed, and must name the storing entity to the BNetzA on request.
Designated IP address retention store
ICS can operate the retention store as the storing entity you name to the BNetzA.
1
Gap analysis
ICS checks your RADIUS, packet core and CGNAT logging against § 177 TKG-E.
2
Data feeds
Connectors collect data from your AAA systems, gateways and NAT devices, or from your host network.
3
Separated store
An encrypted store keeps only the required fields and deletes them automatically.
4
Lookup
IP address, port and time resolve to the line and then to the subscriber.
5
Answering requests
Responses go out via ESB or E-Mail-ESB.
6
תיעוד
ICS prepares the BNetzA documentation and supports audits.
Data retention instruments compared
| היבט | Subscriber data request | Quick freeze | שמירת כתובות IP |
|---|---|---|---|
| הבסיס המשפטי | § 174 לחוק התקשורת (TKG) | § 176 TKG-E (planned) | § 177 TKG-E (planned) |
| Trigger | Individual request | Individual order | None, applies to all connections |
| Obligated parties | Providers holding subscriber data | Public telecom services and participants (approx. 3,000) | Internet access providers (approx. 700) |
| נתונים | Subscriber data, such as name and address | Traffic data incl. location and cell data, no content | Public IP or prefix, ports, line and user ID, timestamps |
| Duration | Answered from existing records | Up to 3 months, plus up to 3 months by court order | 3 months |
| Disclosure | On request of an authorized body | Only on a separate request | Only for subscriber identification and e-Evidence |
| ICS service | Subscriber Data Warehouse | Quick freeze service | Designated retention store |
Handover standards and e-Evidence
Retained data can be handed over per ETSI TS 102 657. German requests use the ESB and E-Mail-ESB channels. Under the e-Evidence Regulation, a European Preservation Order requires preservation for 60 days, extendable by 30 days. Our פלטפורמת תאימות לראיות דיגיטליות handles these orders alongside national requests.
מדוע ICS
01
ניסיון של יותר מ-20 שנים
ICS has worked in telecommunications, lawful interception and compliance for more than two decades.
02
אישורים מרובים מטעם ה-BNetzA
ICS interception solutions have passed multiple acceptance procedures with the German Federal Network Agency.
03
עובדים בעלי סיווג ביטחוני
צוותנו קיבל אישור ביטחוני ממשרד הפנים הפדרלי הגרמני, והוא רשאי לטפל במידע מסווג.
04
All request types in one place
Subscriber requests, quick freeze, IP address retention and e-Evidence are handled with one process and one audit trail.
שאלות נפוצות
Is Germany reintroducing general data retention?
Not in its previous form. Germany’s former data retention rules have not been enforced since 2017, and the CJEU found them incompatible with EU law in 2022. The government draft BT-Drs. 21/6581 instead limits general storage to IP address assignments for three months and adds a targeted quick freeze procedure. The bill is still in parliament.
What is quick freeze?
Quick freeze is a procedure in which authorities order a provider to preserve existing traffic data about specific persons or locations without delay. Under the draft (§ 100g StPO, § 176 TKG-E), the order lasts up to three months and a court can extend it by up to three months. The data may only be disclosed on a separate request and must otherwise be deleted.
Who must store IP addresses under § 177 TKG-E?
Providers of internet access services, which the draft puts at around 700 companies. Messenger and e-mail services and local Wi-Fi hotspots, such as hotel Wi-Fi, are not covered by this duty. MVNOs and resellers with their own customer relationship are covered. If the host network assigns the IP address, they must ensure storage by contract or data feed.
Is RADIUS accounting enough for IP address retention?
RADIUS accounting covers the assigned IP address, the identifiers and the timestamps. Behind carrier-grade NAT, however, port mappings are created in the NAT gateway, not in the AAA system. Providers using CGNAT therefore also need NAT logging. ICS checks your logging in a gap analysis and closes the gaps before the deadline.
Can ICS store frozen or retained data on our behalf?
Yes. The quick freeze draft explicitly covers those who participate in providing telecommunications services, and § 177 (2) TKG-E allows storage by another entity. ICS can act as your service provider and be named to the BNetzA as the storing entity. You remain the obligated party, and ICS handles storage, disclosure and deletion.
Does the Subscriber Data Warehouse move our data to the cloud?
No. The Subscriber Data Warehouse is deployed on your own infrastructure with no cloud dependencies, so data never leaves your network. It uses open-source components, logs every search and gives you full ownership of the data. Custom ETL pipelines extract data from billing, provisioning, CRM and legacy systems without migrating them.
Six months pass quickly
Once § 177 TKG-E enters into force, internet access providers will have six months to comply. Start your readiness assessment with ICS now.