API / Developer Platform
APIs are invisible to users — but not to regulators.
APIs that process, transmit, or store personal data are fully in scope of GDPR and NIS2. Machine-to-machine communication doesn't reduce your obligations — it increases them.
Realitätscheck
Do your API consumers know exactly what data you process on their behalf, and do you have DPAs in place?
GDPR (General Data Protection Regulation)
mandatory Art. 28, Art. 32, Art. 33Ihre Pflichten
- API-level access control and authentication
- Data Processing Agreements for API consumers
- Rate limiting to prevent data scraping
- Logging of data access for audit trail
- Data minimisation in API responses
SiteGuardian überwacht dies
- TLS/HTTPS encryption monitoring
- Automated cookie consent detection
- Security headers analysis
- Email transport encryption checks
- Breach notification SLA tracking (72h)
- Digital DPA/AVV signing
Risiko bei Nichteinhaltung
API data leaks are reportable breaches. No DPA = both parties liable. Scraping incidents = security violation.
NIS2 Directive (Cybersecurity)
conditional Art. 21, Art. 23Ihre Pflichten
- API security monitoring and anomaly detection
- Vulnerability management for API endpoints
- Incident response plan for API compromise
- Supply chain documentation for API dependencies
SiteGuardian überwacht dies
- 24h/72h/1m incident reporting SLA
- DNSSEC and DNS security monitoring
- Security headers and TLS enforcement
- Uptime and availability monitoring
- Supply chain risk scoring
- Incident auto-classification (NIS2 Art. 23)
Risiko bei Nichteinhaltung
API providers are in NIS2 scope if they serve essential or important entities. Shared responsibility model.
Digital Services Act (DSA)
conditional Art. 14, Art. 16, Art. 27Ihre Pflichten
- Transparency reporting on content moderation
- Notice-and-action mechanism for illegal content
- Terms of service clarity requirements
- Algorithmic transparency for recommender systems
Risiko bei Nichteinhaltung
Fines up to 6% of global turnover. Service restrictions in the EU.
Betrifft Sie das?
Wenn Sie 2 oder mehr mit Ja beantworten, gelten diese Vorschriften sehr wahrscheinlich für Ihr Unternehmen.
Sehen Sie, wo Sie stehen
Unser kostenloser Scanner prüft die Sicherheitslage Ihrer Website, SSL, Header, E-Mail-Authentifizierung und mehr. Kein Konto erforderlich.
Scan your API endpoint's securityDiese Seite bietet allgemeine Informationen zu EU-Regulierungsrahmen. Sie stellt keine Rechtsberatung dar. Wenden Sie sich für eine auf Ihre Situation zugeschnittene Beratung an einen qualifizierten Rechtsanwalt. SiteGuardian dokumentiert Ihr Monitoring kontinuierlich — Compliance liegt in der Verantwortung Ihrer Organisation.