Austria Data Protection Act (DSG)

Why does it matter?

The DSG decides questions the GDPR leaves to member states: the age at which a child can consent to online services, whether and how cameras may record, what employees must keep secret, and how complaints and fines work in Austria.

Key benefits include:

• Apply the right Austrian rule

Know which choices Austria made inside the GDPR’s opening clauses, so controls match the national text and not only the EU regulation.

• Avoid unlawful camera systems

Check every recording against §§ 12–13, including the ban on recording to control employees and the labeling duty.

• Protect against insider disclosure

Bind employees to data secrecy under § 6 and keep the instruction records that show it was done.

• Answer the DSB

Prepare for complaints under § 24 with records, owners and deadlines, and know the appeal route to the Bundesverwaltungsgericht.

• Keep research and statistics lawful

Use the § 7 rules for archiving, research and statistics, including pseudonymization and removal of personal reference.

How does it work?

The GDPR applies directly in Austria; the DSG does not copy it. Article 1 of the Act (§ 1) holds the constitutional right to data protection. In Article 2, Part 1 (§§ 4–13) fills the GDPR’s opening clauses with national rules, Part 2 (§§ 14–35j) sets up the organs, including the DSB and the Datenschutzrat, and the complaint, liability and fine rules, Part 3 (§§ 36–59) governs processing for police, security and criminal-justice purposes, and Part 4 (§§ 62–63) holds the penal provisions.

The DSB investigates complaints (§ 24), can demand information and inspect processing (§ 22), and imposes fines (§ 22(5)). Under § 30 it can fine a legal person for violations by managers or for missing supervision, and § 30(5) excludes fines against authorities and public bodies. Section 62 adds administrative penalties of up to EUR 50,000 for offenses such as unlawful access to data, breach of data secrecy and unlawful image processing, unless GDPR Article 83 or a stricter rule applies, and § 63 makes processing with intent to enrich or harm a court offense. DSB decisions can be appealed to the Bundesverwaltungsgericht (§ 27), and damages claims go to the regional civil court (§ 29).

A company processing Austrian residents’ data adds these tasks to its GDPR program: keep records of processing; run a data protection impact assessment where the DSB’s DSFA-V regulation requires one for image processing; check the age-14 threshold for consent-based online services offered to children; bind employees to data secrecy and instruct them; label cameras, log processing and delete recordings as § 13 requires; and handle DSB complaints and data subject requests with owners and deadlines.

In SmartSuite, teams run these tasks in the Privacy Management solution: a data inventory and records of processing, DPIAs with templates and scoring, DSAR and rights request tracking and dashboards for open actions, with Forms and Activity History keeping the evidence.

Key Elements

• Constitutional right to data protection (§ 1)

Everyone has a right to secrecy of personal data concerning them where a protectable interest exists; restrictions need an overriding legitimate interest, and state restrictions need a law that is necessary for a reason listed in Article 8(2) ECHR and uses the mildest effective means.

• Children’s consent (§ 4(4))

For an information-society service offered directly to a child, consent under GDPR Article 6(1)(a) is lawful once the child has completed the 14th year of life.

• Limits on access requests (§ 4(5)–(6))

The GDPR right of access does not apply to a controller acting in a sovereign capacity where it would endanger a statutory task, and as a rule does not apply where it would endanger a trade or business secret.

• Data secrecy (§ 6)

Controllers, processors and their employees must keep personal data entrusted through their work secret unless a lawful reason to transmit exists; employees transmit data only on explicit instruction, are contractually bound, including after employment ends, and must be instructed on the rules and the consequences of breach.

• Archiving, research and statistics (§ 7)

Data that is public, was lawfully collected for other purposes or is pseudonymized may be processed for work without personal results; otherwise a legal basis, consent or DSB authorization is needed, and personal reference is removed once it is no longer necessary.

• Freedom of expression and media privilege (§ 9)

Processing by media owners, publishers and media employees for journalistic purposes is exempt from parts of the GDPR, including Articles 13, 14 and 21(1), and §§ 12–13 do not apply; the Constitutional Court repealed the earlier § 9(1) and the rewritten text applies from 1 Jul 2024.

• Image processing (§§ 12–13)

Recording is allowed on a vital interest, consent, a legal provision or an overriding and proportionate legitimate interest, but never in the highly personal sphere without express consent and never to control employees; recordings must be labeled, processing logged and data deleted when no longer needed, with storage beyond 72 hours proportionate and separately logged and justified.

What does it cover?

The DSG applies together with the GDPR to wholly or partly automated processing of natural persons’ personal data and to non-automated processing in a filing system (§ 4(1)), by public and private controllers and processors; Part 3 takes precedence for police, security and criminal-justice processing. The image processing rules cover recording for private purposes, and the DSB applies them to company camera systems, including workplace monitoring. The current text has no territorial clause of its own (former §§ 2 and 3 were repealed in 2019), so GDPR Article 3 and the competence rules decide whether a foreign company is caught, and counsel should confirm those cases.

What are its objectives?

The DSG pursues these objectives beside the GDPR:

Guarantee the constitutional right to data protection and define its limits.

Fill the GDPR’s opening clauses with Austrian rules on children’s consent, data secrecy, research and media.

Limit camera surveillance and prohibit recording to control employees.

Give data subjects a complaint route to the DSB and an appeal to a court.

Establish an independent supervisory authority with inspection and fine powers.

Penalize unlawful access to data, breaches of data secrecy and misuse of data to enrich or harm.

Framework in Context

The GDPR applies directly in every member state and the DSG fills its opening clauses, so read the two together with the EU GDPR framework page; the Act also covers the national rules for police and criminal-justice processing in Part 3.

Key dates:

31 Jul 2017: Datenschutz-Anpassungsgesetz 2018 (BGBl. I Nr. 120/2017) promulgated.

15 May 2018: Datenschutz-Deregulierungs-Gesetz 2018 (BGBl. I Nr. 24/2018) promulgated.

25 May 2018: the reworked DSG applies alongside the GDPR (§ 70(9) and (12)).

14 Dec 2022: the Constitutional Court (G 287/2022) repeals the former § 9(1), effective at the end of 30 Jun 2024.

1 Jul 2024: the rewritten § 9 on freedom of expression applies (BGBl. I Nr. 62/2024).

14 Oct 2026: the consolidated text in RIS lists BGBl. I Nr. 50/2025 as the latest amendment.

Common Framework Mappings

Organizations map the Austrian Data Protection Act to international privacy and security standards to harmonize controls, simplify compliance across jurisdictions, and support cross‑border data transfers and vendor assurance.

Mapped frameworks include:

APEC Privacy Framework

EU ePrivacy Directive

EU General Data Protection Regulation (GDPR)

ISO/IEC 27001

ISO/IEC 27701

NIST Privacy Framework

OECD Guidelines on the Protection of Privacy and Transborder Flows of Personal Data