RU EN
www.
Technical audit · 29.05.2026

bsi.bund.de

German Federal Office for Information Security
DE

BSI — Germany's national cybersecurity authority. 108 requests, 1 domain. BundesSans v3-014 and BundesSerif served locally. Matomo with opt-out via a cookie banner, matomoTracking cookie documented. OpenStreetMap only on explicit user request. No external domains in the HAR. Full compliance.

Request timeline

+133 ms · load
CSS and all resources from www.bsi.bund.de. IT-SiKongress 2026, Hall of Fame, NIS2 banner, KRITIS — information security content, all local.
+139 ms · fonts
BundesSansWeb v3-014 (Regular, Italic, Bold) and BundesSerifWeb (Regular, Italic) — a fifth typeface — served from the proprietary server.
+458 ms · JS
www.bsi.bund.de/global.js — the only JS file. Standard federal platform.
No external domains
108 requests — all to www.bsi.bund.de. Matomo is not activated. OpenStreetMap only when maps are explicitly used. Set-Cookie — zero.

Declared versus actual

✓ Matomo (matomoTracking cookie) — documented in detail with a cookie table — declared
✓ IP anonymization — 'Nullen von zwei Stellen des IP-Bereichs' — declared
✓ OpenStreetMap — documented with Art. 6(1)(a) (Einwilligung when the map is used) — declared
✓ Log files (Protokolldateien) on ITZBund — documented (30 days) — declared

Context

BSI (Bundesamt für Sicherheit in der Informationstechnik) is Germany’s national cybersecurity authority. It publishes vulnerability advisories, IT security standards (BSI-Grundschutz), certifies security products, and maintains a Hall of Fame for security researchers. HAR: 108 requests, 1 domain. The page content covers IT-SiKongress 2026, NIS2, and KRITIS — all within the information security domain.

Documentation — the most detailed in the German series

BSI’s privacy policy (121,775 characters) is the most detailed of all German sites in the series. It contains a structured data-processing table with columns for: category, data, subject, purpose, retention period. Separately documented: log files (Protokolldateien, 30 days, ITZBund, Art. 6(1)(e)), session cookies (no PII), the matomoTracking cookie (with a full description of the data collected and the IP anonymization mechanism), and OpenStreetMap (only when the map is explicitly used, Einwilligung).

For the matomoTracking cookie, the policy states precisely what is collected: anonymized IP (two octets replaced with zeros), the page opened, the previous page (referrer), time, browser, OS, resolution. The level of detail exceeds the requirements of GDPR Art. 13.

OpenStreetMap — consent on use

BSI’s site contains interactive OpenStreetMap maps — for example, to show the location of cybersecurity centers. The policy documents this as a separate category: the IP address is transmitted to OpenStreetMap only when the map is used, with the legal basis being Art. 6(1)(a) DSGVO (Einwilligung). There are no requests to OpenStreetMap in the HAR — the map does not load on the homepage without explicit interaction.

BSI as the standard for the federal platform

BSI is the authority that issues technical security standards for all federal bodies. Its own website embodies the same principles. The architecture is identical to other sites in the German series (BMJV, BBK, BND) with one addition — extremely detailed documentation exceeding the minimum GDPR requirements. This is no accident: BSI publishes data-protection recommendations for the federal administration.

Conclusion

bsi.bund.de is the sixth zero result in the German series. The federal cybersecurity authority implements a privacy standard consistent with its institutional function: one domain, government hosting, detailed documentation for every processing category, and correct opt-out for Matomo. BSI is precisely the body that sets the standards the rest of the German series follows.

Evidence

How to verify: download the file and compute its checksum — sha256sum file.har (Linux, macOS) or certutil -hashfile file.har SHA256 (Windows); it must match the one shown. The conclusions apply to the scope of this measurement — see the limitations of the method.

Original (audit)
HAR file: de/bsi-bund-de-2026-05-29.har
SHA-256: 2feb39fc697ed6bfd9798bed0fbd9249030f636f9e96aa633dd378cabbb7b307
HAR files are stored on EU infrastructure (Proton Drive). SHA-256 is published for integrity verification.
Want a response from the company about this audit? → Open the tool

Fill in once — it will be inserted into every letter below:

All fields are required to print the document — this is a formal requirement of the letter itself (the particulars of an official submission), not data collection: nothing is sent or saved anywhere, it all stays in your browser and disappears when you close the page. See the methodology for details.

Step 1. Data access request (GDPR Art. 15)

Send this letter directly to the company first — before contacting the regulator it has the right to respond (GDPR Art. 12(3) — 30 days).

Subject: Data access request (GDPR Art. 15) — bsi.bund.de

To: [insert the company's address — DPO / support / legal department]
From: [Your name], [contact email]

I request access to my personal data processed in connection with the website bsi.bund.de.

1. Categories of data and purposes of processing (Art. 15(1)(a)-(c))
I request information on all categories, purposes, and recipients of my data processed on this site — regardless of whether any non-compliance has been identified to date.

2. Recipients, retention periods, and transfers outside the EEA (Art. 15(1)(c)-(d), 46)
I also request the full list of third-party recipients, the applicable retention period for each category, and the legal basis for any transfer of data outside the EEA. The full technical audit with evidence (saved network log, SHA-256 checksum) is published at: https://gdpru.eu/en/audits/de-bsi-bund-de/

3. Automated processing and profiling (Art. 15(1)(h))
Please state whether I am subject to automated decision-making or profiling, and if so, disclose the logic involved.

Sincerely,

[Your name]
[contact email]
[Country]


[Date]