Provisions on regulatory fines

(1) It is a regulatory offence for whoever, contrary to section 39(1), first sentence in conjunction with a statutory instrument under section 56(4), first sentence, fails to provide evidence correctly or completely.
(2) It is a regulatory offence for whoever, wilfully or negligently,
1. acts contrary to an enforceable order under
a) section 11(6), section 16(1), first sentence, also in conjunction with subsection (4), section 17, first sentence or section 39(1), fifth sentence,
b) section 14(2), first sentence,
c) sections 18, 40(5), first sentence or section 61(3), first sentence or (6), first or third sentence or (7), first or third sentence or (8), in each case also in conjunction with section 62, or
d) section 35(1), first sentence or section 36(2), first sentence,
2. fails to take a measure named in section 30(1), first sentence, or takes it incorrectly, incompletely or not in time,
3. fails to document compliance with the obligation under section 30(1), third sentence, or documents it incorrectly or incompletely,
4. fails to make a report under section 32(1), first sentence, or makes it incorrectly, incompletely or not in time,
5. fails to submit a final report under section 32(2), second sentence, or submits it incorrectly, incompletely or not in time,
6. fails to transmit a particular under section 33(1) or (2), second sentence, in each case also in conjunction with a statutory instrument under section 56(4), first sentence, or under section 34(1), or transmits it incorrectly, incompletely or not in time,
7. fails to ensure, contrary to section 33(2), third sentence, that it is reachable,
8. fails to inform the BSI under section 34(2), or informs it incorrectly, incompletely or not in time,
9. fails to make a notification under section 35(2), first sentence, also in conjunction with the second sentence, or makes it incorrectly, incompletely or not in time,
10. fails to provide evidence under section 39(1), first sentence in conjunction with a statutory instrument under section 56(4), first sentence, or fails to provide it in time,
11. fails to make a notification or particular under section 41(5), second sentence, or makes it incorrectly, incompletely or not in time,
12. fails to maintain a requirement or procedure named in section 49(3), first sentence,
13. fails to make accessible a requirement, procedure or data named in section 49(3), second sentence or subsection (4), or fails to make it accessible in the prescribed manner or in time,
14. fails to grant access under section 50(1), first sentence, or fails to grant it in time,
15. uses a certificate, declaration or mark named in section 52(2), fourth sentence, section 53(1), fourth sentence, section 54(6), second sentence or section 55(4), first sentence, contrary to those provisions,
16. becomes active contrary to section 53(3), second sentence or section 54(2), second sentence, or
17. fails, contrary to section 61(5), third sentence, to permit entry to a room named there, fails to submit a record, document or other paper named there, or fails to do so correctly, completely or in time, or fails to provide information, or fails to do so correctly, completely or in time.
(3) It is a regulatory offence for whoever negligently commits an act described in subsection (1).
(4) It is a regulatory offence for whoever infringes Regulation (EU) 2019/881, as amended on 19 December 2024, by, wilfully or negligently,
1. failing to make a particular named in Article 55(1) accessible, or failing to do so correctly, completely or within one month of issuance, or
2. failing, contrary to Article 56(8), first sentence, to give information, or failing to do so correctly, completely or without delay after detecting a security gap or irregularity.
(5) The regulatory offence may be punished:
1. in the cases of subsection (2), no. 1(d), nos. 2 to 5 and 9,
a) for essential entities under section 28(1), first sentence, with a regulatory fine of up to EUR 10 million,
b) for important entities within the meaning of section 28(2), first sentence, with a regulatory fine of up to EUR 7 million,
2. in the cases of subsection (2), no. 11, with a regulatory fine of up to EUR 5 million,
3. in the cases of subsection (2), no. 1(a), with a regulatory fine of up to EUR 2 million,
4. in the cases of subsection (1) and subsection (2), no. 10, with a regulatory fine of up to EUR 1 million,
5. in the cases of subsection (2), no. 1(c), nos. 6, 8, 12 to 16 and subsection (4), with a regulatory fine of up to EUR 500,000, and
6. in the cases of subsection (2), no. 1(b), nos. 7 and 17 and subsection (3), with a regulatory fine of up to EUR 100,000. In the cases of the first sentence, nos. 3 and 4, section 30(2), third sentence of the Act on Regulatory Offences applies.
(6) As against an essential entity within the meaning of section 28(1), first sentence with a total turnover exceeding EUR 500 million, a regulatory offence in the cases of subsection (2), no. 1(d), nos. 2 to 5 and 9 may, by way of derogation from subsection (5), first sentence, no. 1(a), also in conjunction with section 30(2), second sentence of the Act on Regulatory Offences, be punished by a regulatory fine of up to 2 per cent of the total turnover.
(7) As against an important entity within the meaning of section 28(2), first sentence with a total turnover exceeding EUR 500 million, a regulatory offence in the cases of subsection (2), no. 1(d), nos. 2 to 5 and 9 may, by way of derogation from subsection (5), first sentence, no. 1(b), also in conjunction with section 30(2), second sentence of the Act on Regulatory Offences, be punished by a regulatory fine of up to 1.4 per cent of the total turnover.
(8) Total turnover within the meaning of subsections (6) and (7) is the sum of all turnover that the undertaking to which the essential entity or the important entity belongs achieved worldwide in the business year preceding the authority's decision. Total turnover may be estimated.
(9) Section 17(2) of the Act on Regulatory Offences does not apply in the cases of subsection (5), first sentence, no. 1 and of subsections (6) and (7).
(10) The administrative authority within the meaning of section 36(1), no. 1 of the Act on Regulatory Offences is
1. in the cases of subsection (2), no. 11, the Federal Ministry of the Interior, and
2. in the cases of subsections (1), (3) and (4) and in the cases of subsection (2) not named in no. 1, the BSI.
(11) Where the supervisory authorities named in Article 55 or 56 of Regulation (EU) 2016/679 impose a fine under Article 58(2)(i) of Regulation (EU) 2016/679, a further fine may not be imposed for an infringement under this Act arising from the same conduct as the infringement that was the subject of the fine under Article 58(2)(i) of Regulation (EU) 2016/679.