NIS2 · NISG 2026 · BSIG · GDPR
NIS2 is in force: in Austria since 1 October 2026, in Germany since 6 December 2025. In both countries management must attend cybersecurity training, and training for employees is part of the entity's duties. Protectly delivers the training and the participation record as an export, hosted in the EU, exclusively in Germany on request, and reported in a works-council-friendly way.
Sources: BGBl. I No. 94/2025 (Austria) (opens in a new tab), BGBl. 2025 I No. 301 (Germany) (opens in a new tab)
Austria and Germany have transposed NIS2 into national law. Switzerland is not an EU member and has its own rules.
One EU directive, national lawsThe basis is the NIS2 Directive (EU) 2022/2555. It does not apply directly: each member state transposes it into its own national law and sets its own details on scope, competent authorities, registration and fines. Two requirements of the directive apply in every member state: Art. 20(2) requires training for management bodies, and Art. 21(2)(g) lists basic cyber hygiene practices and cybersecurity training as part of risk management.
NIS2 transposition in EU countries (European Commission) (opens in a new tab)
AustriaNetwork and Information Systems Security Act 2026 (NISG 2026), BGBl. I No. 94/2025, in force since 1 October 2026.
NISG 2026 in the Austrian Federal Legal Information System (RIS, in German) (opens in a new tab)
GermanyBSI Act (BSIG) as amended by the German NIS2 Implementation Act, BGBl. 2025 I No. 301, in force since 6 December 2025.
BSI Act on gesetze-im-internet.de (in German) (opens in a new tab)
Whether and how your organisation is affected follows from the law that applies to it. This page is not legal advice.
How the requirements map to what Protectly delivers, and the record you receive.
| Requirement | How you meet it with Protectly | Your proof |
|---|---|---|
| Training of management bodies§ 31 Abs. 2 NISG 2026, § 38 Abs. 3 BSIG | Dedicated training for the leadership level, such as the German-language courses "NIS2 Management Training (3D)" and "Informationssicherheit für Führungskräfte" (information security for executives). | Participation record as an export |
| Regular training of employees§ 31 Abs. 2 NISG 2026, § 30 Abs. 2 Nr. 7 BSIG | More than 80 trainings, including information security, data protection and compliance, as microlearning, 2D or 3D. | Export of training progress and participation |
| Everyday cyber hygieneArt. 21(2)(g) NIS2 | Phishing simulations with an MS365 report button, so suspicious emails are reported with one click. | Anonymised click and report rates as a report |
View matching courses (in German): NIS2 Management Training (3D), Informationssicherheit für Führungskräfte, All courses
We tell you exactly what applies today and what is still in preparation.
| Area | Current status |
|---|---|
| ISO 27001Information security | Our information security follows the principles of ISO 27001. Certification is in preparation. |
| BSI IT-GrundschutzSecurity concept | A technical security concept based on BSI IT-Grundschutz exists. You receive it on request. |
| GDPRData protection | Data processing agreement (DPA) and deletion concept on request, reporting only anonymised and aggregated. |
| HostingEU data centres, Germany only on request | Operated with providers certified to ISO 27001 or BSI C5: Open Telekom Cloud of Deutsche Telekom (region eu-de) and Hetzner. |
Today Protectly runs in German data centres of Open Telekom Cloud (Deutsche Telekom, region eu-de) and Hetzner. These providers are certified to ISO 27001 or BSI C5, not Protectly itself. Backups are stored encrypted at a separate location.
This is what your IT security team usually checks first.
For tenders, data protection and IT security we provide these documents on request:
Or write to us directly at office@protectly.eu.
Protectly is a product of Smart-Study GmbH, based in Graz with an office in Vienna. More than 60,000 people use Smart-Study products.
Your data stays in the EU, exclusively in Germany on request. Today, operation takes place in German data centres of Open Telekom Cloud (Deutsche Telekom) and Hetzner. Both providers are certified to ISO 27001 or BSI C5. You receive a current overview of sub-processors on request.
Yes. We send you the data processing agreement on request. Reporting is anonymised and aggregated.
Retention and deletion are governed by our deletion concept, which you receive on request. We keep encrypted backups for no more than about six months.
Yes. Reporting is anonymised and aggregated at group or department level, there is no individual evaluation. You can agree the rollout with your works council.
Training progress and participation can be exported in an audit-ready form. Documents on our security measures, such as the technical security concept, are available on request.
