Rights
GDPR through the DSG, supervised by the Datenschutzbehörde
Data protection rests on the GDPR, supplemented by the Austrian Data Protection Act (DSG), which uniquely elevates a core right to data protection to constitutional rank. The Datenschutzbehörde is the single national supervisory authority for both the public and private sectors.
Key rules
- Processing requires a GDPR lawful basis; the DSG adds national rules, including on employee and image data.
- The DSG contains a constitutionally ranked fundamental right to data protection (§1).
- Breaches presenting a risk must be notified to the Datenschutzbehörde, in principle within 72 hours.
Governing law
- General Data Protection Regulation (Regulation (EU) 2016/679)
- Data Protection Act (Datenschutzgesetz, DSG)National implementation; constitutional data-protection right
Penalties and consequences
- GDPR fines up to EUR 20 million or 4% of worldwide annual turnover
- Orders and processing bans from the Datenschutzbehörde
In practice
Austria's early practice favoured warnings over fines for first infringements, though enforcement has firmed up. The constitutional ranking of §1 DSG means a data-protection claim can, in principle, reach the Constitutional Court.