bsi.bund.de

Context

BSI (Bundesamt für Sicherheit in der Informationstechnik) is Germany’s national cybersecurity authority. It publishes vulnerability advisories, IT security standards (BSI-Grundschutz), certifies security products, and maintains a Hall of Fame for security researchers. HAR: 108 requests, 1 domain. The page content covers IT-SiKongress 2026, NIS2, and KRITIS — all within the information security domain.

Documentation — the most detailed in the German series

BSI’s privacy policy (121,775 characters) is the most detailed of all German sites in the series. It contains a structured data-processing table with columns for: category, data, subject, purpose, retention period. Separately documented: log files (Protokolldateien, 30 days, ITZBund, Art. 6(1)(e)), session cookies (no PII), the matomoTracking cookie (with a full description of the data collected and the IP anonymization mechanism), and OpenStreetMap (only when the map is explicitly used, Einwilligung).

For the matomoTracking cookie, the policy states precisely what is collected: anonymized IP (two octets replaced with zeros), the page opened, the previous page (referrer), time, browser, OS, resolution. The level of detail exceeds the requirements of GDPR Art. 13.

OpenStreetMap — consent on use

BSI’s site contains interactive OpenStreetMap maps — for example, to show the location of cybersecurity centers. The policy documents this as a separate category: the IP address is transmitted to OpenStreetMap only when the map is used, with the legal basis being Art. 6(1)(a) DSGVO (Einwilligung). There are no requests to OpenStreetMap in the HAR — the map does not load on the homepage without explicit interaction.

BSI as the standard for the federal platform

BSI is the authority that issues technical security standards for all federal bodies. Its own website embodies the same principles. The architecture is identical to other sites in the German series (BMJV, BBK, BND) with one addition — extremely detailed documentation exceeding the minimum GDPR requirements. This is no accident: BSI publishes data-protection recommendations for the federal administration.

Conclusion

bsi.bund.de is the sixth zero result in the German series. The federal cybersecurity authority implements a privacy standard consistent with its institutional function: one domain, government hosting, detailed documentation for every processing category, and correct opt-out for Matomo. BSI is precisely the body that sets the standards the rest of the German series follows.