A data centre for the BSI, not for the Energy Efficiency Act

A basement in an administrative building. Three racks, a UPS, an air conditioning unit on the wall, together perhaps forty kilowatts. Asked about the data centre, the head of IT replies: "We don't have one, we have a server room."

That is right. And wrong. It depends on who is asking.

The Energy Efficiency Act counts kilowatts

The German Energy Efficiency Act (EnEfG) defines a data centre in Section 3 No. 24 by its power. It means a structure for centrally housing, connecting and operating IT and network equipment, together with the installations for power distribution, climate control and security, (our translation)

"with a non-redundant rated electrical connection capacity of 300 kilowatts or more"

Pure network nodes are excluded. The basement with forty kilowatts is therefore not subject to the data centre obligations, neither the PUE limits from part 1 nor the annual report.

Smaller organisations still often overlook two points. Anyone running servers in someone else's data centre can be an operator of information technology, under Section 3 No. 4 from a non-redundant rated connection capacity of just 50 kilowatts. Under Section 12(5), the obligations regarding an energy or environmental management system apply accordingly. And for data centres owned by or operated for public bodies, the obligation to have this system validated or certified starts under Section 12(3) at 300 kilowatts instead of one megawatt.

The thresholds may still change. The amendment to the Act has not been adopted; the Committee for Economic Affairs and Energy held a hearing on it on 5 October. Whether it changes the reference value of the definition is presented differently in the analyses so far.

IT-Grundschutz counts importance

Module INF.2 Data centre and server room does not ask about kilowatts. Its definition has six points, the first of which reads (our translation):

"If an IT-using institution has only one central IT operations area, this area together with the necessary support areas is generally always to be treated as a data centre in line with its protection requirements."

The fourth point goes further: an area with IT for critical business processes is always to be treated as a data centre, regardless of size or share rules. The module states itself what it is based on (our translation):

"This definition is based exclusively on the importance of the IT structure for the tasks of the using institution and is thus methodologically consistent with EN 50600."

For IT-Grundschutz, the basement with forty kilowatts is therefore usually a data centre. Anyone wanting to treat it as a server room may do so, but must justify the reduced requirements soundly and comprehensibly and implement at least the basic requirements. Only for very small environments does the BSI refer to a different module: INF.2 is not suitable for information domains with only one or very few servers, where INF.5 Room and cabinet for technical infrastructure is often sufficient.

Two questions, two answers

"Are we a data centre?" is therefore not one question but two:

• Under the Energy Efficiency Act: How high is the non-redundant rated connection capacity, and what is it derived from? If it is below the threshold, the energy obligations for data centres do not apply, but not necessarily those as an operator of information technology in someone else's data centre.
• Under IT-Grundschutz: Is it the only central IT operations area, or does it run IT for critical processes? Then INF.2 applies, with the standard of a data centre or a justified reduction.

The most common misunderstanding is to use the answer to the first question for both. "We are too small" is true for energy law and is no argument for security.

How isidaten represents this

In Data centre compliance, the data centre is a delimited object, and the connection capacity is derived from the distribution model in DCIM, with the list of outgoing circuits it is built from. If the distribution model is missing, there is no value but a reason, because a zero would look like "below every threshold". The scope judgement is dated and knows, besides affected and not affected, also "not assessable" and "not yet applicable". Law in force and government draft are kept as separate rulebooks.

The check question

Which number is your "we are not a data centre" based on, and which of the two definitions was meant?

If there is no number, it is an estimate. And if only one definition was meant, the other is missing.

Sources

Energy Efficiency Act (EnEfG), Section 3 No. 4 and No. 24, Section 12(3) and (5) (German). German Bundestag, hearing in the Committee for Economic Affairs and Energy on 05.10.2026, printed paper 21/8027 (German). BSI IT-Grundschutz Kompendium, 2023 edition, module INF.2, sections 1.1 and 1.3 (German). EN 50600 in substance, text of the standard protected by copyright.

In the next part: why an A/B feed is only redundant when each side can carry the load alone. The previous part: A PUE from the data sheet is not a measurement.