The permits required depend on the location, size, and technical design. As a general rule, building permits are required. This also applies if an existing building that was previously used for a different purpose is to be converted into a data center. Depending on the project, permits under emission control laws (particularly for emergency power generators) may be required, as well as other environmental permits such as those under nature conservation laws or—for example, when using groundwater—permits or authorizations under water laws.

Experience has shown that clarifying the admissibility under building and planning law at an early stage—including possible new adoptions or amendments to zoning plans—is necessary to avoid later delays in the project timeline.

Site selection decisions should take technical, economic, and legal criteria into account collectively. In addition to land availability and transportation access, the following factors are particularly important:

• Availability and capacity of the electrical grid connection,

• Proximity to an Internet exchange point,

• fiber-optic and telecommunications connectivity,

• compliance with zoning regulations and potential for expansion,

• connectivity to existing or planned district heating networks,

• water availability (especially for liquid cooling),

• sustainability requirements and energy efficiency standards,

• local community acceptance, and potential conflicts of use.

Emergency power generators that run on fossil fuels, such as diesel, are a typical component of every data center.

If the thermal output of the generators exceeds certain thresholds at a given location, the installation and operation of the emergency power generators require a permit under emission control regulations. At colocation and hyperscaler sites (hyperscalers are scalable cloud computing systems consisting of a large number of servers connected in a network), this threshold is regularly reached and significantly shapes the permitting timeline.

Therefore, as early as the conceptual phase, it should be assessed whether the project falls within the scope of the Federal Immission Control Act (BImSchG).

As early as possible. The availability of grid connection capacity, substations, and power lines is one of the key hurdles to data center operation today. Operators should reserve grid connections early on, enter into power purchase agreements (PPAs), and secure battery energy storage systems (BESS) as a backup. In practice, commitments regarding connections and supply have a greater impact on the project timeline than the building permit application.

Under the EnEfG, operators of data centers with a non-redundant nominal connection capacity of 300 kW or more are required to report certain energy consumption data to the Energy Efficiency Register. The Federal Office for Energy Efficiency (BfEE) within the Federal Office for Economic Affairs and Export Control (BAFA) maintains the register. The key obligations include:

• covering 50% of electricity consumption with electricity from renewable energy sources as of January 1, 2024, and 100% as of January 1, 2027;

• Establishing an energy or environmental management system (typically in accordance with DIN EN ISO 50001) by July 1, 2025; validation or certification starting January 1, 2026—mandatory for a rated connected load of 1 MW or more (private sector) or 300 kW or more (public entities);

• Documentation of energy audits, efficiency measures, and energy-saving targets;

• Annual reporting requirements to the BfEE regarding waste heat pursuant to Section 17 of the EnEfG, with the data made public via the Waste Heat Platform.

Which obligations apply in individual cases depends in particular on the date of commissioning, size, and operating model of the data center. The legal framework is not static: An amendment to the EnEfG is currently in the works, which is expected to significantly alter, among other things, thresholds, PUE limits, waste heat obligations, and reporting requirements. Operators and investors should keep a close eye on these developments to address risks early on.

The law distinguishes between existing and new facilities:

• For data centers commissioned before July 1, 2026, a PUE value of ≤ 1.5 applies as of July 1, 2027, and a PUE value of ≤ 1.3 applies as of July 1, 2030, based on an annual average; for data centers commissioned on or after July 1, 2026, a PUE value of ≤ 1.2 applies no later than two years after commissioning.

• New facilities are also subject to mandatory minimum energy reuse targets: 10% for facilities commissioned on or after July 1, 2026; 15% on or after July 1, 2027; and 20% on or after July 1, 2028.

Compliance with these values requires early-stage design of cooling, measurement technology, and heat recovery—ideally as early as the permitting phase.

Depending on the project phase and type of investor, various models may be considered:

• Asset or share deals for the acquisition of existing sites,

• joint ventures between developers, hyperscalers (leading cloud service providers), and energy suppliers,

• special purpose vehicles (SPVs) for greenfield developments,

• sale-and-lease-back arrangements to free up capital,

• forward-funding and forward-purchase structures,

• infrastructure and project financing, often in conjunction with long-term colocation or wholesale agreements (= an agreement under which a network operator leases its infrastructure to other service providers).

The choice of structure should take equal account of financing, operations, exit strategy, tax treatment, and regulatory requirements.

Beyond traditional real estate due diligence, the focus typically includes:

• grid connection and energy supply security, including PPAs, reservations, and BESS (Battery Energy Storage Systems),

• permit status, including the Federal Immission Control Act (BImSchG), water and nature conservation laws,

• Energy Efficiency Act (EnEfG) compliance (PUE values, renewable energy quota, Energy Management System (EnMS), reporting obligations),

• waste heat agreements and obligations toward municipalities,

• lease, colocation, and service-level agreements,

• Data protection, IT security, and KRITIS/NIS2 status (critical infrastructure; NIS II Directive, EU 2022/2555),

• Dependence on key suppliers (cooling, uninterruptible power supply, generators),

• Expansion and scaling potential.

Given the dynamic regulatory landscape—particularly the increasing requirements for energy efficiency and the mandatory use of renewable energy—the legal and economic risks for data center operators and builders are also rising. The legal situation should therefore be monitored on an ongoing basis to address regulatory risks at an early stage.

Above certain thresholds, data centers may fall under both

(i) the KRITISDachG (Umbrella Act on Strengthening the Physical Resilience of Critical Infrastructure) and 

(ii) the BSIG (Act on the Federal Office for Information Security and on Information Security at Institutions).

Both sets of regulations form parallel frameworks for the protection of critical infrastructure—the KRITISDachG for physical protection and the BSIG for cybersecurity. Operators face significant compliance obligations under both frameworks, including requirements for registration, risk analysis, and incident reporting. Since both sets of regulations apply concurrently and cumulatively, they must always be assessed in parallel.

Due to these comprehensive requirements and legal provisions, operators must address the legal hurdles as early as possible to ensure the smooth establishment of such a data center—particularly with regard to security requirements and energy efficiency standards.

In addition to the general obligations, international actors are also subject in particular to:

• Foreign investment control laws (AWG (Foreign Trade Act) / AWV (Foreign Trade Ordinance))—relevant, among other things, for acquisitions of critical infrastructure by non-EU investors,

• data protection laws (GDPR and transfers to third countries),

• telecommunications law and, where applicable, EU cyber and AI regulations,

• energy and subsidy law requirements, including the EnEfG (Energy Efficiency Act) and the EED (Energy Efficiency Directive),

• ESG (Environmental, Social, and Governance) and sustainability requirements (CSRD (Corporate Sustainability Reporting Directive), EU Taxonomy).

For cross-border projects, an early-stage regulatory analysis is recommended, with a clear allocation of responsibilities between the parent company, the holding company, and the German project company.

At the federal level, a National Data Center Strategy is currently being developed that is intended to address, among other things, the grid connection regime, urban land-use planning (possible preferential treatment under the BauGB), and tax and subsidy incentives. At the same time, an amendment to the Energy Efficiency Act (EnEfG) is in the works, which could adjust key obligations (see above, section 5). We are closely monitoring these developments and incorporating them into ongoing projects and transactions.