GDPR Complete Package Austria: What AT Companies Need Differently

1. AT-specific particularities

Austria applies the GDPR unchanged — what differs is the national framework on top: the DSG instead of the BDSG, a single supervisory authority instead of state authorities and the BfDI, plus its own rules on image recordings, research and data secrecy. The GDPR applies directly across the EU. However, every Member State has national opening clauses. In Austria, the DSG (Datenschutzgesetz, BGBl. I Nr. 165/1999) gives specific shape to the following areas:

• § 5 DSG: position of the data protection officer — duty of secrecy and (in the public sector) freedom from instructions; the designation obligation itself follows directly from Art. 37 GDPR. Practical recommendation: check and document the ground for designation under Art. 37(1) GDPR and have the secrecy undertaking under § 5 DSG signed separately. In Austria, protection against dismissal from the role and against penalisation follows from Art. 38(3) GDPR.
• § 6 DSG: data secrecy — controllers, Data Processors and their employees are bound to secrecy. Practical recommendation: include the data secrecy undertaking in the employment contract and attach it to the data processing agreement. It carries sanctions: anyone who intentionally transmits data in breach of data secrecy commits an administrative offence under § 62(1) DSG — subsidiary, details in section 6.
• § 7 DSG: processing for archiving purposes, scientific or historical research purposes or statistical purposes.
• § 11 DSG: reprimand by the Datenschutzbehörde — proportionate application of Art. 83 GDPR; set out in section 6.
• § 12 DSG: admissibility of image recording (video surveillance) — a separate special rule; among other things, image recording for the purpose of monitoring employees is inadmissible (§ 12(4) no. 2 DSG). Before Putting into Service, it must additionally be checked whether a data protection impact assessment is required: Art. 35(3) GDPR expressly mentions systematic monitoring of publicly accessible areas on a large scale.
• § 13 DSG: special data security measures and labelling of image recordings — labelling obligation (subsection 5) and the 72-hour rule for retention (subsection 3).
• § 44(2) in conjunction with § 43(4) DSG: restriction of the right of access in the 3rd main part (security police and criminal prosecution) — this concerns authorities, not companies. For companies, Art. 12(3) GDPR therefore continues to apply: a response without undue delay, at the latest within one month.

Important: The Austrian DSG contains no dedicated employee data protection provision of the kind Germany has with § 26 BDSG. What governs is Art. 6 and Art. 88 GDPR, supplemented by § 12(4) no. 2 DSG and § 96(1) no. 3 of the Austrian Labour Constitution Act (ArbVG) (monitoring measures that affect human dignity only with the works council's consent or a works agreement). Anyone adopting a German template must therefore at least replace the references to § 26 BDSG and § 38(1) BDSG: both are German supplementary provisions and do not apply in Austria.

2. DPO obligation in Austria

In Austria, the obligation to designate a data protection officer is governed solely by Art. 37(1) GDPR — there is no additional numerical threshold as there is in Germany. Under Art. 37(1) GDPR, a DPO is mandatory in the case of:

• public authorities and public bodies (Art. 37(1)(a) GDPR)
• companies whose core activity is profiling or regular monitoring on a large scale (Art. 37(1)(b) GDPR: regular and systematic monitoring of data subjects on a large scale)
• companies processing special categories of data (Art. 9) on a large scale (Art. 37(1)(c) GDPR, likewise for data on criminal convictions under Art. 10)

Important: Austria has NO headcount threshold as Germany does (§ 38(1) BDSG: at least 20 persons constantly engaged in automated processing). The threshold is expressly worded as 'in addition to Article 37(1)(b) and (c)' GDPR — a German tightening, not an exemption; the DPO obligation can therefore bite earlier in Germany than in Austria. § 5 DSG itself does not create an additional designation obligation; it only governs secrecy, the right to refuse to give evidence and freedom from instructions in the public sector. The German head start goes further than the figure of 20 suggests: § 38(1) BDSG requires a DPO irrespective of the number of persons also where processing operations are subject to a data protection impact assessment under Art. 35 GDPR, or where data are processed on a commercial basis for the purpose of transmission, anonymised transmission, or for the purposes of market or opinion research.

Position and tasks in Austria: The data protection officer must not be dismissed from the role or penalised for performing their tasks (Art. 38(3) GDPR); the German protection against termination under § 6(4) BDSG does not apply in Austria. Data subjects may contact the DPO with regard to all issues related to the processing of their data (Art. 38(4) GDPR). The catalogue of tasks follows from Art. 39(1)(a) to (e) GDPR: informing and advising, monitoring compliance including awareness-raising and training, advising on the data protection impact assessment, cooperating with the supervisory authority and acting as its contact point. Designation is based on professional qualities and expert knowledge (Art. 37(5) GDPR) — the provision does not require legal training. Groups with an AT subsidiary may designate a single data protection officer under Art. 37(2) GDPR, provided that they are easily accessible from each establishment. Practical steps after the designation: inform the supervisory authority of the designation informally — in Austria the Datenschutzbehörde via dsb.gv.at — and add the data protection officer's contact details to the Privacy notice on the website.

3. Austrian Data Protection Authority (Datenschutzbehörde)

A single supervisory authority is competent for the whole of Austria — unlike Germany, where competence depends on the federal state and the type of body. Official designation: Datenschutzbehörde — it is established under § 18(1) DSG as the national supervisory authority pursuant to Art. 51 GDPR. Address: Barichgasse 40-42, 1030 Vienna. Website: dsb.gv.at. An online complaint form is available.

The difference is organisational, not substantive: Art. 51(1) GDPR requires each Member State to have one or more independent supervisory authorities. Germany has split this task — the authorities competent under state law supervise non-public bodies (§ 40(1) BDSG), while the BfDI is responsible for federal public bodies and certain providers of telecommunications services (§ 9(1) BDSG). Austria has bundled it. For an AT company this means: one address for complaints, Personal Data Breach notifications and queries from the authority. The same authority decides on administrative fines under § 62 DSG (§ 62(5) DSG).

What an AT company must expect in the event of a complaint is determined by four legal anchors — details on the penalty provisions in section 6:

• Competence: the Datenschutzbehörde as the single supervisory authority (§ 18(1) DSG)
• Fines: range under Art. 83(4) or (5) GDPR, tiered by the type of infringement
• Standard of application: proportionate under § 11 DSG, in particular a reprimand instead of a fine for first-time infringements
• National fallback provision: administrative penalty of up to EUR 50,000 under § 62(1) DSG, subsidiary only

Practical recommendation for your own preparation (based on experience from supervisory proceedings, not a requirement of the Austrian Data Protection Authority and not a statutory sequence): keep the documents ready in the order in which an inspection typically builds up — record of processing activities, then data processing agreements, then the concept for technical and organisational measures, then the data protection impact assessments for the high-risk processing operations.

4. Typical GDPR cases in Austria

Six constellations decide in practice whether a German document package works in Austria: video surveillance, employee monitoring, newsletters, cookie banners, processing on behalf of a controller and access requests. The middle column names the governing provision, the right-hand column a practical implementation step. Practice here is only the form of implementation — the provisions cited in the right-hand column (Art. 7(1) and (3), Art. 12(3), Art. 28(3) GDPR as well as § 6 DSG) apply regardless.

5. AT adaptations in the GDPR document set

A document package usable in Austria differs from the German one in seven places — where a German supplementary provision has to be replaced, where no national provision exists at all, or where AT-typical processing operations and the Austrian supervisory authority have to be reflected. A document set for an AT company should therefore cover the following modules:

1. Privacy notice under Art. 13/14 GDPR naming the Austrian Data Protection Authority as the body for complaints (Art. 13(2)(d) GDPR). What specifically has to be replaced are the authority's name, address and complaint route; in addition, the legal basis under Art. 6(1) GDPR must be included for each purpose (consent, contract, legal obligation, vital interests, public interest, legitimate interest), as well as the data protection officer's contact details.
2. DPO appointment under Art. 37 GDPR (template + contract), position and secrecy under § 5 DSG. The contract should reflect the catalogue of tasks in Art. 39(1)(a) to (e) GDPR, govern accessibility for data subjects under Art. 38(4) GDPR and name the prohibition of dismissal from the role and of penalisation in Art. 38(3) GDPR — not § 6(4) BDSG, which applies only in Germany.
3. ROPA under Art. 30 GDPR with AT-typical processing operations (social insurance registration, ÖGK). Art. 30 applies word for word in Austria: seven mandatory items in subsection 1 (a) to (g), which practice splits into eight fields because of the bundled item (c) and supplements with the legal basis as a ninth field. Data Processors keep their own, shorter record with four mandatory items (Art. 30(2)(a) to (d)). The 250-employee exemption in Art. 30(5) applies only cumulatively and in practice already fails on the criterion of regular processing.
4. Video surveillance concept under §§ 12, 13 DSG — admissibility, labelling, retention period and preliminary DPIA assessment as described in section 1 and section 4; the concept brings these points together per camera in an auditable document.
5. Employee data protection: works agreement on monitoring measures under § 96(1) no. 3 ArbVG (the DSG contains no provision of its own on this). Where health data are processed, the general prohibition on processing in Art. 9(1) GDPR additionally applies, with the narrow exceptions in subsection 2.
6. Workflow for handling Datenschutzbehörde complaints. The workflow needs two timelines: your own response deadline vis-à-vis the data subject under Art. 12(3) GDPR (deadlines and extension see section 4) and communication with the Datenschutzbehörde as the competent supervisory authority under § 18(1) DSG.
7. Research / statistics clauses under § 7 DSG (for universities, R&D departments). Practical recommendation: keep research processing as a separate entry in the record of processing activities, with its own description of purpose, its own categories of recipients and its own deletion rules — otherwise it blurs into operational processing and becomes a point of contention during an inspection.

6. Personal Data Breach in Austria: reporting route, deadlines, evidence

A notifiable Personal Data Breach goes to the Datenschutzbehörde in Austria — not to a German state authority and not to the BfDI. The obligations under Art. 33 and Art. 34 GDPR themselves apply unchanged in Austria; what differs nationally is the addressee and a supplementary administrative penalty provision.

Under Art. 33(1) GDPR, the controller notifies a personal data breach without undue delay and, where feasible, within 72 hours after having become aware of it — unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the notification is not made within 72 hours, reasons for the delay must be given. In Austria, the competent body is the Datenschutzbehörde as the national supervisory authority under Art. 51 GDPR (§ 18(1) DSG), reachable via dsb.gv.at. In terms of content, Art. 33(3) GDPR requires a description of the breach, the approximate number of data subjects and records concerned, the data categories, the likely consequences, the measures for remedying and mitigating the damage, as well as the contact details of the data protection officer or the controller.

Where a high risk is likely, a second stage is added: communication to the data subjects without undue delay and in clear, plain language (Art. 34(1) GDPR). It is not required under Art. 34(3) GDPR where appropriate technical and organisational protection measures — in particular encryption — have been applied, where subsequent measures have eliminated the high risk, or where individual communication would involve disproportionate effort; a public communication then takes its place. Irrespective of this, every breach must be documented, including one that is not notified (Art. 33(5) GDPR) — together with the reasons why no notification was made.

The following sequence is a practical rhythm, not a statutory timetable: the only fixed deadline in this table is the 72-hour limit in Art. 33(1) GDPR; the communication under Art. 34(1) GDPR must be made without undue delay.

Art. 83 GDPR is tiered by the type of infringement: up to EUR 10 million or 2 % of the total worldwide annual turnover, whichever is higher, for infringements of, among other things, obligations under Art. 25 to 39 GDPR (subsection 4), and up to EUR 20 million or 4 % of the total worldwide annual turnover, whichever is higher, for infringements of the processing principles, the conditions for consent and the data subject rights in Art. 12 to 22 GDPR (subsection 5). Austria softens the application: under § 11 DSG, the Datenschutzbehörde applies Art. 83 GDPR proportionately and, in particular for first-time infringements, makes use of a reprimand instead of a fine. In addition to these fines, Austria has a national fallback provision: § 62(1) DSG makes certain acts punishable as administrative offences with fines of up to EUR 50,000 — among them intentional unlawful access to a data processing operation and the intentional transmission of data in breach of data secrecy under § 6 DSG. The provision applies only subsidiarily: insofar as the act does not already fulfil an element of Art. 83 GDPR or is subject to more severe penalties under other administrative penalty provisions. The Datenschutzbehörde is competent for these decisions (§ 62(5) DSG).

7. Germany and Austria compared directly

The difference between a German and an Austrian set of documents lies almost entirely in the national framework on top — the GDPR articles themselves are the same in both countries. The table names, for each legal area, the provision from which the answer follows; where only a GDPR provision is given, directly applicable EU law carries the answer on its own.

Practical consequence: wherever the AT column names a different provision from the DE column, a German template refers to the wrong rule; where both columns name the same GDPR provision — for example the record of processing activities and processing on behalf of a controller — it carries over unchanged, supplemented in the case of processing on behalf of a controller by data secrecy under § 6 DSG. What has to be exchanged are the citations of provisions, the details of the authority and the complaint address; for employee data protection and video surveillance a separate AT document is added in each case — the works agreement under § 96(1) no. 3 ArbVG and the concept under §§ 12, 13 DSG.

8. NISG 2026: a separate reporting procedure from 1 October 2026

The GDPR notification and the cybersecurity report under the NISG 2026 are two separate procedures with different addressees, deadlines and triggers — the NISG 2026 obligations are applicable in Austria from 1 October 2026. One incident can trigger both procedures at the same time — the trigger, the addressee and the deadline must therefore each be assessed separately.

Anyone falling under the NISG 2026 must additionally register from 1 October 2026: within three months with the Cybersecurity Authority (Cybersicherheitsbehörde, Austria), and changes to core data within two weeks (§ 29(2) to (4) NISG 2026). Under § 3a NISG 2026, the competent authority is the Federal Office for Cybersecurity (Cybersicherheitsbehörde), an authority subordinate to the Federal Minister of the Interior with nationwide competence and its seat in Vienna. The penalty range differs from that in data protection law: administrative offences under § 45(1) NISG 2026 carry fines of up to EUR 10 million or 2 % of the total worldwide annual turnover for essential entities, and up to EUR 7 million or 1.4 % for important entities, whichever is higher (§ 45(2) and (3) NISG 2026); other offences are punishable with up to EUR 50,000, and EUR 100,000 in the event of repetition (§ 45(4) NISG 2026).