German Cyber Law

Mon, 06 Jul 2026 00:00:00 +0000

The BSI-Gesetz and IT-Sicherheitsgesetz

The primary statutory framework for cybersecurity in Germany is founded upon the BSI-Gesetz, which establishes the Bundesamt für Sicherheit in der Informationstechnik as the national cybersecurity authority, and the IT-Sicherheitsgesetz, which imposes sector-specific cybersecurity obligations on operators of critical infrastructure. The IT-Sicherheitsgesetz 2.0, enacted in May 2021, significantly expands the scope of the original 2015 legislation by extending mandatory security requirements and incident reporting obligations to companies of particular public interest — including manufacturers of critical components, cloud computing service providers, and companies in the defence, energy, and telecommunications sectors. The amendments introduced a regulatory framework for the detection of IT vulnerabilities, empowering the BSI to conduct automated scans and to inspect source code and other proprietary information where necessary to eliminate security deficiencies. The BSI is also authorised under the revised Act to issue administrative fines of up to €2 million for non-compliance with reporting obligations and up to €50,000 for failure to implement required organisational and technical measures. The Act requires operators of critical infrastructure to deploy systems for attack detection, to report significant IT security incidents to the BSI, and to demonstrate compliance every two years through audits conducted by accredited certification bodies.

cyber law on ExcellentWiki - Legal Encyclopedia

German Cyber Law

The BSI-Gesetz and IT-Sicherheitsgesetz