Europe
Government software by country
For all 27 EU member states: how government is organised, who provides the shared IT and which applications public bodies use. The assessment uses this overview as its starting point and checks it against your own organisation.
The 27 member states
| Country | Data-protection authority | Security baseline | Applications | |
|---|---|---|---|---|
| Austria | Datenschutzbehörde (DSB, Austrian Data Protection Authority) | Österreichisches Informationssicherheitshandbuch (Austrian Information Security Handbook) for public administration; NIS2 implementation; PM-SAP and HV run under ISO 27001 at BMF/BRZ | 54 | View |
| Belgium | Gegevensbeschermingsautoriteit (GBA) / Autorité de protection des données (APD), the Data Protection Authority; in Flanders also the Vlaamse Toezichtcommissie (VTC) | CyberFundamentals Framework of the Centre for Cybersecurity Belgium (CCB), the reference framework under the Belgian NIS2 law; social security sector: Minimale normen informatieveiligheid (KSZ/BCSS) | 60 | View |
| Bulgaria | Комисия за защита на личните данни (Commission for Personal Data Protection, CPDP) | Закон за киберсигурност (Cybersecurity Act) with the Наредба за минималните изисквания за мрежова и информационна сигурност (Ordinance on minimum network and information security requirements) | 45 | View |
| Croatia | Agencija za zaštitu osobnih podataka, AZOP (Croatian Personal Data Protection Agency) | Zakon o kibernetičkoj sigurnosti (Cybersecurity Act, NIS2 transposition, 2024) with its implementing decree; Zakon o informacijskoj sigurnosti (Information Security Act) with ZSIS and UVNS standards for classified information | 53 | View |
| Cyprus | Grafeio Epitropou Prostasias Dedomenon Prosopikou Charaktira (Office of the Commissioner for Personal Data Protection) | The Digital Security Authority (Archi Psifiakis Asfaleias, DSA) sets security requirements under Law 89(I)/2020 (NIS) and its NIS2 successor, together with the national CSIRT-CY | 48 | View |
| Czechia | Úřad pro ochranu osobních údajů, ÚOOÚ (Office for Personal Data Protection) | Act 264/2025 Sb. on cybersecurity (NIS2 implementation, in force since 1 November 2025, supervised by NÚKIB) with decrees 409 to 412/2025 Sb. on security measures, security levels of public information systems and cloud use | 60 | View |
| Denmark | Datatilsynet (Danish Data Protection Agency) | ISO/IEC 27001 is mandatory for all state authorities; municipalities and regions follow ISO 27001 based practice; NIS2 is implemented in national law | 60 | View |
| Estonia | Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate) | E-ITS (Eesti infoturbestandard): mandatory information security baseline for public bodies, maintained by RIA and based on BSI IT-Grundschutz (successor to ISKE) | 60 | View |
| Finland | Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman) | Julkri (information security assessment criteria for public administration, successor to the VAHTI guidelines) under the Act on Information Management in Public Administration (906/2019); Katakri for classified information | 59 | View |
| France | Commission nationale de l'informatique et des libertés (CNIL, French Data Protection Authority) | RGS (Référentiel général de sécurité, ANSSI) and PSSIE (state information security policy); SecNumCloud qualification for sensitive cloud hosting; NIS2 transposition in progress | 80 | View |
| Germany | Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (BfDI, Federal Commissioner for Data Protection and Freedom of Information), plus 16 Land data protection authorities | BSI IT-Grundschutz (BSI-Standards 200-1 to 200-4) and BSI Mindeststandards for the federal administration; NIS2 implementation | 77 | View |
| Greece | Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα (Hellenic Data Protection Authority, HDPA) | Law 5160/2024 (NIS2 transposition); national authority: Εθνική Αρχή Κυβερνοασφάλειας (National Cybersecurity Authority) | 60 | View |
| Hungary | Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, National Authority for Data Protection and Freedom of Information) | 2024. évi LXIX. törvény (Cybersecurity Act, NIS2 transposition, successor to the 2013. évi L. törvény), with security classes for electronic information systems of state and municipal bodies | 51 | View |
| Ireland | An Coimisiún um Chosaint Sonraí (Data Protection Commission, DPC) | Cyber Security Baseline Standards (2022) of the National Cyber Security Centre and OGCIO, for all public service bodies; NIS2 transposition via the National Cyber Security Bill | 79 | View |
| Italy | Garante per la protezione dei dati personali (Italian Data Protection Authority) | Misure minime di sicurezza ICT per le PA (AgID Circolare 2/2017); cloud qualification by ACN (Agenzia per la Cybersicurezza Nazionale) and the Perimetro di sicurezza nazionale cibernetica; NIS2 transposed by D.Lgs. 138/2024 | 60 | View |
| Latvia | Datu valsts inspekcija (Data State Inspectorate) | Nacionālās kiberdrošības likums (National Cybersecurity Law, 2024, NIS2 transposition) with Cabinet regulations on minimum cybersecurity requirements; CERT.LV is the national CSIRT. | 52 | View |
| Lithuania | Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate) | Kibernetinio saugumo įstatymas (Cyber Security Law, NIS2 transposition) and the government's organisational and technical cyber security requirements, supervised by Nacionalinis kibernetinio saugumo centras (NKSC) | 56 | View |
| Luxembourg | Commission nationale pour la protection des données (CNPD, National Commission for Data Protection) | Politique générale de sécurité de l'information (PSI) of the State and the ANSSI/HCPN security reference framework (référentiel de sécurité) for public bodies | 49 | View |
| Malta | Uffiċċju tal-Kummissarju għall-Informazzjoni u l-Protezzjoni tad-Data (Information and Data Protection Commissioner, IDPC) | GMICT Policies, Directives and Standards, issued by MITA for all ICT of the Government of Malta. | 45 | View |
| Netherlands | Autoriteit Persoonsgegevens (AP, Dutch Data Protection Authority) | BIO (Baseline Informatiebeveiliging Overheid): the common information security baseline for central government, provinces, municipalities and water boards, based on ISO/IEC 27001/27002. | 120 | View |
| Poland | Prezes Urzędu Ochrony Danych Osobowych, UODO (President of the Personal Data Protection Office) | Krajowe Ramy Interoperacyjności (KRI, national interoperability and information security requirements) and the KSC act (ustawa o krajowym systemie cyberbezpieczeństwa); the amended KSC act transposing NIS2 has applied since 3 April 2026. | 59 | View |
| Portugal | Comissão Nacional de Proteção de Dados (CNPD, National Data Protection Commission) | Regime Jurídico da Cibersegurança (Decreto-Lei 125/2025, NIS2 transposition, supervised by CNCS) with the Quadro Nacional de Referência para a Cibersegurança (QNRCS, based on NIST CSF 2.0). | 54 | View |
| Romania | Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP, National Supervisory Authority for Personal Data Processing) | OUG 155/2024 transposing NIS2 (approved by Law 124/2025), supervised by DNSC (Directoratul Național de Securitate Cibernetică). | 54 | View |
| Slovakia | Úrad na ochranu osobných údajov Slovenskej republiky (Office for Personal Data Protection of the Slovak Republic) | Act 69/2018 on cybersecurity (supervised by NBÚ, National Security Authority) and Act 95/2019 on IT in public administration, with MIRRI decree 179/2020 Z. z. on security measures. | 60 | View |
| Slovenia | Informacijski pooblaščenec (Information Commissioner) | Zakon o informacijski varnosti (ZInfV, Information Security Act, updated for NIS2) with Uredba o informacijski varnosti; supervised by Urad Vlade RS za informacijsko varnost (URSIV). | 60 | View |
| Spain | Agencia Española de Protección de Datos (AEPD, Spanish Data Protection Agency); regional authorities in Catalonia (APDCAT) and the Basque Country (AVPD) | Esquema Nacional de Seguridad (ENS, Real Decreto 311/2022), applying to the whole public sector and its contracted providers, with CCN-STIC guides from the Centro Criptológico Nacional; Esquema Nacional de Interoperabilidad (ENI, Real Decreto 4/2010) | 60 | View |
| Sweden | Integritetsskyddsmyndigheten (IMY, Swedish Authority for Privacy Protection) | MSB regulations MSBFS 2020:6 (information security for state agencies, supported by ISO/IEC 27001) and MSBFS 2020:7 (security measures in information systems); NIS2 transposed through the Cybersäkerhetslag. | 60 | View |
Overview based on public sources, as of 17 October 2026. A listing says nothing about contracts or suitability; the assessment checks each organisation.