- Legal Basis
- § 202d StGB
- Sentencing Range
- Imprisonment up to three years or a fine
- Summary
- Acquiring, providing access to, or making available to another person data that was unlawfully obtained and is not generally accessible
Handling Stolen Data (Section 202d StGB)
Handling stolen data (Handling Stolen Data) was introduced into the German Criminal Code in 2015 as a comparatively new offence. It addresses dealings with unlawfully obtained data and closes a gap in criminal liability that existed when stolen datasets were resold or distributed without the acquirer having participated in the original offence. The provision is particularly relevant in the context of trading in stolen credentials, credit card information, and personal data — a growing concern for expats and businesses operating in Germany’s digital economy.
Legal Basis
Section 202d(1) of the German Criminal Code (StGB) provides:
“Anyone who acquires for themselves or another, provides to another, distributes, or otherwise makes accessible data (Section 202a(2)) that is not generally accessible and that another person obtained through an unlawful act, in order to enrich themselves or a third party or to cause harm to another, shall be punished with imprisonment of up to three years or a fine.”
Section 202d(2) StGB contains an important exception: the provision does not apply to acts that exclusively serve the fulfilment of lawful official or professional duties, particularly press and media reporting.
Elements of the Offence
Data within the meaning of Section 202a(2) StGB: Covered are data stored or transmitted electronically, magnetically, or in a form not directly perceptible.
Not generally accessible: The data must not be generally accessible. Freely available information on the internet does not fall under the offence, but data accessible only to a limited group of persons does.
Obtained through an unlawful act: The data must have been obtained through an unlawful act, such as data espionage (Section 202a StGB), data interception (Section 202b StGB), or computer fraud. The offender must know of the unlawful origin or at least accept the possibility.
Acts of commission: Covered are acquiring, providing, distributing, and otherwise making accessible. Unlike traditional handling of stolen goods (Section 259 StGB), the initial acquisition (not just resale) is also punishable.
Intent to enrich or to cause harm: The offender must act with the intention of enriching themselves or a third party, or of causing harm to another. Mere curiosity does not suffice.
Typical Methods of Commission
Typical cases include buying or selling stolen credentials (passwords, accounts) on the darknet, trading in illegally obtained credit card datasets, distributing customer databases obtained through hacking, offering stolen personal data in specialised forums, and acquiring corporate data obtained through industrial espionage.
Sentencing Range
Handling stolen data carries a penalty of up to three years’ imprisonment or a fine. The sentencing range is oriented towards the predicate offence. Where the offence coincides with other crimes, such as fraud or money laundering, an aggregate sentence is formed, which can lead to a significantly higher penalty.
Typical Defence Strategies
A key defence approach concerns knowledge of the unlawful origin of the data. If the accused did not know that the data originated from a criminal offence, the required intent is absent. Furthermore, it must be examined whether the data was truly “not generally accessible” — if it had already been publicly distributed, the offence element is not satisfied. The intent to enrich or cause harm must be positively demonstrated; mere collection of data without a specific purpose of exploitation is insufficient. Finally, the exception for professional duties (Section 202d(2) StGB) may apply, for instance for journalists or IT security researchers.
Frequently Asked Questions
Was ist Handling Stolen Data?
Nach § 202d StGB ist das Sichverschaffen, Überlassen oder Verbreiten rechtswidrig erlangter Daten strafbar, wenn dies zur Bereicherung oder zur Schädigung eines anderen geschieht.
Welche Strafe droht?
Freiheitsstrafe bis zu drei Jahren oder Geldstrafe.
Welche Verteidigungsansätze gibt es?
Geprüft werden die Herkunft der Daten, der Vorsatz sowie mögliche Privilegierungen, etwa für berufliche Tätigkeiten.
Muss ich zur Polizei, wenn ich als Beschuldigter vorgeladen werde?
Einer rein polizeilichen Police Summons müssen Sie als Beschuldigter nicht folgen, und Sie sind nie verpflichtet, sich zur Sache zu äußern. Einer Ladung der Staatsanwaltschaft oder des Gerichts sollten Sie folgen – schweigen dürfen Sie aber auch dort.
Sollte ich vor der Akteneinsicht aussagen?
In aller Regel nein. Ohne Kenntnis der Ermittlungsakte lässt sich nicht beurteilen, welche Beweise vorliegen. Eine Einlassung sollte erst nach Akteneinsicht und in Abstimmung mit dem Verteidiger erfolgen.
Kann ein Strafverfahren eingestellt werden?
Ja. Je nach Beweislage kommen eine Einstellung mangels hinreichenden Tatverdachts (§ 170 II StPO), wegen Geringfügigkeit (§ 153 StPO) oder gegen Auflagen (§ 153a StPO) in Betracht. Nach Akteneinsicht prüfen wir die Möglichkeiten.
Summons or accusation of Handling Stolen Data? What matters now
Make no statement to the police at first
As an accused person you are never obliged to comment on the allegation. Anything said to the police can be used against you. Provide statements only through your defense attorney and only after reviewing the case file.
File inspection comes first
A sound defense against the allegation of Handling Stolen Data requires knowledge of the investigation file. Only once the available evidence is clear can we decide whether a statement is advisable or whether remaining silent is the better strategy.
Possible discontinuation of proceedings
Not every case ends in a main hearing. Depending on the evidence and any prior record, the proceedings may be discontinued for lack of sufficient suspicion (§ 170 II StPO), for triviality (§ 153 StPO) or subject to conditions (§ 153a StPO). Often a penalty order without a public trial can be achieved.
Victim-offender mediation and restitution
In many cases, victim-offender mediation or making good the damage (§ 46a StGB) can significantly reduce the sentence or enable a discontinuation. Whether this is advisable in your case is something we assess based on the file.
What we do after reviewing the file
We examine the evidence for reliability and admissibility, look for procedural errors, develop the defense strategy, negotiate with the public prosecutor on a discontinuation and represent you, if necessary, in the main hearing before the District Court or Regional Court of Bonn.
Available 24/7: +49 228 504 463 36
This information does not replace a review of the individual case. In criminal proceedings, the defence strategy depends substantially on the case file, the specific allegation and the evidence.
Why BAFTEH Strafverteidigung?
- Direct contact with your defense attorney – no intermediaries
- Available around the clock, including nights and weekends
- Fast file inspection and a clear defense strategy
- Focused exclusively on criminal law
- Defense in Bonn, Cologne and the entire region
Written by attorney Philip Bafteh, criminal defense lawyer in Bonn. Philip Bafteh publishes regularly on criminal and commercial law and defends accused persons in investigative and trial proceedings.
More about the attorney →Last updated: Juni 2026
Free Initial Assessment
Have you received a summons or are you under investigation? Call us – the initial assessment by phone is free for up to 10 minutes.
+49 228 504 463 36