Archive · Survey period 2026
Privacy notice for the NIS-2 survey
This page documents the privacy notice that applied during the “NIS-2 Realitätscheck 2026” survey. The online survey has ended.
Archive status: Original version February 2026, archived July 2026. The notice remains available for transparency about the completed survey. This English text is a translation of the German original. For questions about this survey, you can now reach me at younes@ahmadzei.de.
1. Controller
Controller within the meaning of the General Data Protection Regulation and other data protection provisions:
Younes Ahmadzeic/o Technische Universität München
School of Computation, Information and Technology (CIT)
Boltzmannstraße 3
85748 Garching bei München
Email: y.ahmadzei@tum.de
2. Purpose of the processing at the time
The website accompanied a non-commercial student research project at the Technical University of Munich. The online survey served the academic study of how far the NIS-2 Directive had been implemented in German SMEs. Results were analysed for research purposes and prepared for the BSI's 21st German IT Security Congress.
3. Survey data
Participation was voluntary. No details such as name or email address that would directly identify participants were requested. The survey was run with Microsoft Forms within the TUM tenant.
According to the notice published during the survey, responses were stored on servers in Germany and were not enriched with additional Microsoft metadata. The survey results were to be deleted completely once they were no longer needed for analysis and presentation after the research project ended.
The legal bases stated were participants' consent under Art. 6(1)(a) GDPR and the interest in academic research under Art. 6(1)(f) GDPR in conjunction with Art. 89(1) GDPR.
4. Hosting
The project page was provided on the web server infrastructure of the Technical University of Munich at home.cit.tum.de. According to the privacy information of the TUM School of Computation, Information and Technology, the web servers are operated by the Leibniz Supercomputing Centre.
Technical access data on the server infrastructure is covered by the privacy terms of the TUM School of CIT.
5. Cookies and external services
The project page did not use its own analytics or tracking tools. For the survey service embedded at the time, the privacy and cookie notices available in the Microsoft Forms form also applied.
6. External links
External websites, such as LinkedIn or HvS-Consulting, are subject to the privacy policies of their respective providers.
7. Rights of data subjects
Subject to the statutory requirements, you have in particular the rights of access, rectification, erasure, restriction of processing, data portability and objection. Consent can be withdrawn with effect for the future.
Because the survey was carried out without directly identifying details, later assigning individual responses to people may be technically impossible or considerably more difficult.
Questions can be sent to y.ahmadzei@tum.de or to the Data Protection Officer of the Technical University of Munich.
8. Right to lodge a complaint
You have the right to lodge a complaint with a competent data protection supervisory authority. For TUM, this is the Bavarian State Commissioner for Data Protection.
9. Current project status
The online survey is complete and the Microsoft Forms form is no longer embedded in the website. Current information on the research project is available in the NIS-2 research archive.