--- title: "Austria Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/austria/ source_html: /jurisdictions/austria/index.html description: "Austria data protection and privacy regulation: 10 categories, 97 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: f6af69857a5e5d2e7646f3e78c03c92d13f4afe087ba31f526f001ad11fde7bb generator: "fe-fleet/md-twin@1.0" --- # Austria Data Protection & Privacy Regulation | Data Protection Monitor Not every instrument is backed by its official text yet. At least one law or rulebook covered here has no official source (tier 1) retrieved for it yet. No finding on this page is shown with confidence above “Probable” until stronger sources are retrieved. # Austria Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/austria/), [World Payments](https://payments.gi/jurisdictions/austria/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 97 claims · 42 sources in the cumulative register Download report (PDF) Expand all The Court of Justice of the European Union's ruling in Case C-416/23, issued in January 2025, has confirmed that Austria's Datenschutzbehörde cannot limit the number of complaints a data subject may file each month, provided the complaints are not genuinely abusive. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Lawful Processing & Special Data, AdTech & Commercial Privacy, Enforcement & Redress (6 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=AUSTRIA)[Build Report](/reports/?j=AUSTRIA)[Compare](/compare/?j=AUSTRIA) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Österreichische Datenschutzbehörde (DSB) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) 2027-04 EU cross-border GDPR enforcement cooperation rules apply Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 0 Red categories 57 Sub-modules 97 Claims 13 Tier-1 sources Traffic-light mix 4 green 6 amber (sums to 10 rendered categories; click to filter) No red categories; 9 sub-modules are flagged red. Law made at European Economic Area (Bloc) level that applies in Austria is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Austria’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 859 Full executive summary 709 ###### Latest update · 25 October 2026 #### Lead Signal Austria's data protection authority is reported to have found that a fully automated credit-scoring process operated by KSV1870, used as the basis for a credit decision by energy supplier Unsere Wasserkraft, amounted to an impermissible automated individual decision under Article 22 of the General Data Protection Regulation, with both companies also found to have fallen short of their transparency obligations toward the individual concerned. This finding is understood from a secondary legal summary rather than the authority's own published decision text, so its exact date and whether it is final or under appeal are not yet established. #### Other Developments Separately, the Datenschutzbehörde's own 2025 activity report records that the number of its decisions published in the federal legal information system rose from nineteen in 2024 to sixty-seven in 2025, an increase the authority attributes to the entry into force of the Informationsfreiheitsgesetz. This is a structural change in how much of the authority's decision-making is made visible to the public, rather than a change in the underlying substantive data protection obligations that apply in Austria. #### Cross-Monitor Connections The automated credit-scoring finding touches on questions of algorithmic decision-making that may also be of interest to anyone tracking artificial-intelligence governance developments, given that both surfaces are concerned with how automated systems are used to make consequential decisions about individuals, though the finding here is framed and assessed strictly as a data protection matter under Article 22 rather than as an artificial-intelligence-specific question. #### Outlook The credit-scoring finding, if confirmed through the authority's own published decision, would be a notable application of Article 22 to a commercial credit-scoring context in Austria; its date, finality and appeal status are the open questions to watch. On transparency, the sharp rise in published decisions suggests more of the Datenschutzbehörde's enforcement and decision-making activity will become visible to practitioners and the public going forward than has historically been the case. 4 earlier updates not shown here. ###### Standing brief · as of 17 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal The Court of Justice of the European Union's ruling in Case C-416/23, issued in January 2025, has confirmed that Austria's Datenschutzbehörde cannot limit the number of complaints a data subject may file each month, provided the complaints are not genuinely abusive. That binding interpretive constraint arrives at a moment when the DSB's own budget has been cut, from roughly EUR 6.1 million in 2025 to EUR 5.9 million for 2026, with a staff complement of approximately 53 to 70 people. Taken together, an uncappable and rising complaint load set against a shrinking regulator budget points to a widening enforcement-capacity gap in Austria's data protection system, a dynamic that sits at the intersection of the data subject rights and enforcement and redress modules tracked in this brief. #### Other Developments Austria's constitutional-rank data protection guarantee remains a standing feature of the framework: Section 1 of the Datenschutzgesetz has guaranteed a fundamental right to data protection for natural and legal persons since 1978, and a 2018 attempt to repeal that provision failed in parliament. Against that backdrop, the DSB's 2025 annual report, published in March 2026, recorded 1,855 data-breach notifications, roughly 7,000 data-subject complaints, more than 200 ex officio proceedings and 127 criminal administrative proceedings, with breach notifications standing as the authority's largest single operational load. The DSB also conducted in-depth audits of telecoms-sector corporations in the most recent reporting year, examining compliance with general personal-data-processing obligations, though this reflects sectoral enforcement focus rather than any new adtech-specific rule. Separately, Austria's Informationsfreiheitsgesetz entered into force on 1 September 2025, assigning the DSB a limited new competence to advise and train bodies subject to that freedom-of-information regime. On the fining side, the DSB completed 214 enforcement procedures in 2024, of which 62 resulted in fines totalling approximately EUR 1.7 million. The applicable fining ceiling remains the GDPR's standard EUR 20 million or 4% of global annual turnover, with the Datenschutzgesetz additionally allowing fines of up to EUR 50,000 for breaches of national provisions not already captured by Article 83 GDPR. Austria was also among 13 Member States that had not publicly announced their national competent authority for the EU AI Act one week before the 2 August 2025 designation deadline; the KI-Servicestelle, hosted by RTR, currently holds only an advisory role pending its evolution into a fully empowered market-surveillance and certification authority. #### Cross-Monitor Connections Austria's incomplete designation of its EU AI Act national competent authority, and the KI-Servicestelle's continuing advisory-only posture, is directly relevant to AI-Act-first framing analysis maintained on the artificial-intelligence monitor; readers tracking that designation gap in fuller technical and institutional detail should consult that monitor rather than this brief. #### Outlook The structural tension between an uncappable, rising complaint intake and a shrinking DSB budget is likely to persist absent a funding correction, and bears watching for its effect on case-processing timelines. Austria's AI Act competent-authority designation remains an open item ahead of the 2 August 2026 high-risk-system applicability date, when the KI-Servicestelle is anticipated to evolve from an advisory information hub into a fully empowered market-surveillance and certification authority. Read full brief · 859 words ###### Latest update · 4 November 2026 #### Regulatory Status The Datenschutzbehörde's reported operating posture is the one area of material movement. Secondary reporting places the regulator's 2026 budget at approximately EUR 5.9 million, down from roughly EUR 6.1 million in 2025, with a staff complement of around 53 permanent positions. That same reporting states the funding reduction has coincided with a pullback from proactive investigations in favour of a complaint-driven enforcement model, against a backdrop of a reported 769% rise in complaint volume since 2017. If accurate, this represents a widening gap between the volume of matters reaching the authority and the resources available to act on them, even though nothing in the underlying statutory architecture has changed: the Datenschutzbehörde continues to operate under its existing GDPR and national-law penalty powers, understood to extend to fines of up to EUR 20 million or 4% of global annual turnover under GDPR, plus separate national-provision fines of up to EUR 50,000 under domestic law. Those figures come from secondary legal commentary rather than from a primary statutory text reviewed. An aggregator source reports a sharp fall in enforcement activity in 2026 to date: approximately 17 enforcement actions totalling around EUR 6,000 in fines, compared with a cumulative total since the authority's inception of roughly 201 actions and approximately EUR 42.5 million. The scale of that apparent drop is consistent with the capacity account above, but the underlying tally has not been checked against the regulator's own annual reporting, and the figures should be read as indicative rather than confirmed. Austria's position among its EU peers is one of a nominally stable enforcement framework operating under reported strain, rather than one of legal change. #### Outlook The aggregator-sourced numbers underlying both the 2026 enforcement tally and the budget figure have not been cross-checked against the Datenschutzbehörde's own activity report, so confirmation of the scale of any slowdown depends on that primary document becoming available. Reported funding levels through the remainder of 2026 bear watching: a sustained reduction in proactive casework, if the secondary account holds up, would be the more durable story here than any single year's fine total, and would mark a widening gap between the volume of complaints the authority receives and the resources it has to act on them. 1 earlier update not shown here. ###### Standing brief · as of 17 August 2026 #### Regulatory Status Austria's data protection framework rests on a constitutional-rank guarantee: Section 1 of the Datenschutzgesetz has protected a fundamental right to data protection for natural and legal persons since 1978, surviving a 2018 repeal attempt in parliament. The Datenschutzbehörde, the national regulator, enters 2026 with a reduced budget of EUR 5.9 million, down from EUR 6.1 million in 2025, and a staff complement of roughly 53 to 70 people. This comes even as the Court of Justice of the European Union's ruling in Case C-416/23, issued in January 2025, bars the DSB from capping the number of monthly complaints a data subject may file. The DSB's 2025 annual report, published in March 2026, recorded 1,855 data-breach notifications, roughly 7,000 data-subject complaints, more than 200 ex officio proceedings, and 127 criminal administrative proceedings. The authority completed 214 enforcement procedures in 2024, with 62 resulting in fines totalling approximately EUR 1.7 million. This applied the GDPR's standard EUR 20 million or 4% of global annual turnover ceiling, alongside a national DSG supplementary fine cap of EUR 50,000. Separately, the DSB conducted in-depth audits of telecoms-sector corporations. It also gained a limited new advisory and training competence under the Informationsfreiheitsgesetz, which entered into force on 1 September 2025. On the AI governance front, Austria was among 13 Member States that had not publicly designated a national competent authority under the EU AI Act as of one week before the 2 August 2025 deadline; its KI-Servicestelle currently holds only an advisory role. #### Outlook Austria's enforcement posture is best read as tightening in practical effect even without new legislation: a binding CJEU constraint on complaint-intake management, a shrinking regulator budget, and continuing fine activity together point to a widening enforcement-capacity gap. The unresolved AI Act competent-authority designation is a second open item bearing on Austria's institutional readiness. Read full brief · 709 words Key regulatory facts for Austria Regulatory Dimension Austria Standing Position Jurisdiction Austria (AT) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 97 sourced findings) Regulator & Framework Fully GDPR-aligned omnibus regime with an operational, EDPB-networked national DPA and consistent CJEU-tested procedural framework. Lawful Processing & Special Data Directly-applicable GDPR core with a narrow, well-documented national research-safeguards overlay; no material derogation gaps identified. Data Subject Rights Core rights are directly enforced by the DSB with a developed body of national and CJEU case law; no material national restriction identified. Controller/Processor Duties Core accountability obligations are GDPR-direct and green, but granular Austria-specific implementation detail (DPIA lists, sectoral retention rules) could not be independently confirmed this pass, warranting amber... Primary Instruments Cited EDPB, EUR-Lex, EUR-Lex, EUR-Lex, EDPB Last Confirmed / Updated 2026-11-04 (42 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Austria: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully GDPR-aligned omnibus regime with an operational, EDPB-networked national DPA and consistent CJEU-tested procedural framework. Primary framework Datenschutzgesetz (DSG) BGBl I No 165/1999, as amended, together with Regulation (EU) 2016/679 (GDPR) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Green Fully GDPR-aligned omnibus regime with an operational, EDPB-networked national DPA and consistent CJEU-tested procedural framework. #### Sub-modules (5) #### Regulator And AuthorityGreen The DSB, based in Vienna, is Austria's independent supervisory authority under the GDPR and DSG. Claims (7): - The Österreichische Datenschutzbehörde (DSB), headquartered at Barichgasse 40-42, Vienna, is Austria's independent data protection supervisory authority responsible for handling complaints and enforcing the GDPR and DSG. - The Datenschutzbehörde (DSB) is Austria's single national supervisory authority under §18(1) DSG. - Datenschutzbehörde (DSB) — 2026 budget of EUR 5.9 million, reduced from EUR 6.1 million in 2025, with approximately 53-70 staff. - Datenschutzbehörde (DSB) — Austria's sole national supervisory authority under Article 51 GDPR, ~70 staff, 2026 budget ~EUR 5.9m (down from EUR 6.1m in 2025). - Datenschutzbehörde (DSB) — DSB is a federal authority with ~70 employees and a EUR 5.9 million 2026 budget (down from EUR 6.1 million in 2025). - Datenschutzbehörde (DSB) — single national DPA, competence for whole of Austria - Datenschutzbehörde (DSB) — The DSB's own public bekanntmachungen feed, checked directly for the window 2026-10-11 to 2026-10-18, shows no new Austria-specific decision, fine or instrument dated in that window beyond bilateral-meeting and EU-level-reference notices. #### Act And InstrumentsGreen DSG supplements GDPR with national procedural rules including a statutory complaints regime under §24 DSG. Claims (6): - The Datenschutzgesetz (DSG), Federal Law Gazette I No 165/1999 as amended, provides that every data subject has the right to lodge a complaint with the DSB and sets a one-year (max. three-year) limitation period under §24 DSG. - Austria's NISG 2026 is a separate cybersecurity-incident reporting regime, distinct from GDPR breach notification, in force from 1 October 2026. - Datenschutzgesetz (DSG) §1 — Guarantees a fundamental right to data protection for natural and legal persons since 1978; a 2018 repeal attempt failed in parliament. - Datenschutzgesetz (DSG) s.1 — Constitutional rank since 1978, guaranteeing a fundamental right to data protection for natural and legal persons; a 2018 repeal attempt failed. - Austria GDPR/DSG framework — Austria applies the GDPR together with the national Datenschutzgesetz (DSG); the DSB is the single supervisory authority nationwide, unlike Germany's federated Länder-DPA model. - NISG 2026 (Network and Information Systems Security Act 2026) — in force from 1 October 2026, addressed to CSIRT not the DSB #### Material ScopeAmber GDPR Art 2 material scope applies; DSG §1's constitutional right can extend protection to processing outside EU-law material scope, subject to CJEU delimitation. Claims (1): - The CJEU held in Case C-33/22 that data processing carried out by a parliamentary committee of inquiry concerning national-security matters may fall outside the material scope of EU law under Article 2(2)(a) GDPR read with Article 4(2) TEU, thereby limiting DSB competence in that narrow category. #### Territorial ScopeGreen GDPR Art 3 territorial scope rules apply directly; no distinct Austrian territorial-scope regime. Claims (1): - GDPR Article 3 territorial-scope rules on establishment and targeting apply directly to controllers/processors in relation to Austria without a distinct national derogation. #### Regulator Registration And FilingGreen No general prior-notification/registration regime exists post-GDPR; DSB levies specific statutory fees for certain filings. Claims (1): - Austria does not require general prior notification or registration of processing activities with the DSB; the DSB instead applies specific statutory fees to certain filings, such as a fixed EUR 30 fee referenced in a DSB decision concerning a commercial-register-related complaint. Austria is an EU Member State operating under the directly-applicable GDPR, supplemented by the national Datenschutzgesetz (DSG, BGBl I No 165/1999 as amended), which establishes the Datenschutzbehörde (DSB) as sole national supervisory authority, sets the constitutional-rank fundamental right to data protection (§1 DSG), and lays down national procedural rules (complaints procedure, limitation periods) for DSB proceedings. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (16) - [EDPB](https://www.edpb.europa.eu/contact/contact-dpas_en) — The Österreichische Datenschutzbehörde (DSB), headquartered at Barichgasse 40-42, Vienna, is Austria's independent data protection supervisory authority responsible for handling complaints and enforcing the GDPR and DSG. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A62024CJ0414) — The Datenschutzgesetz (DSG), Federal Law Gazette I No 165/1999 as amended, provides that every data subject has the right to lodge a complaint with the DSB and sets a one-year (max. three-year) limitation period under §24 DSG. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62022CJ0033) — The CJEU held in Case C-33/22 that data processing carried out by a parliamentary committee of inquiry concerning national-security matters may fall outside the material scope of EU law under Article 2(2)(a) GDPR read with Article 4(2) TEU, thereby limiting DSB competence in that narrow category. - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:32016R0679) — GDPR Article 3 territorial-scope rules on establishment and targeting apply directly to controllers/processors in relation to Austria without a distinct national derogation. - [EDPB](https://www.edpb.europa.eu/system/files/2025-08/at-2025-decision-public.pdf) — Austria does not require general prior notification or registration of processing activities with the DSB; the DSB instead applies specific statutory fees to certain filings, such as a fixed EUR 30 fee referenced in a DSB decision concerning a commercial-register-related complaint. - [https://www.recordinglaw.com/de/world-laws/world-data-privacy-laws/austria-data-privacy-laws/](https://www.recordinglaw.com/de/world-laws/world-data-privacy-laws/austria-data-privacy-laws/) — The Datenschutzbehörde (DSB) is Austria's single national supervisory authority under §18(1) DSG. - [Compliance Kit](https://compliance-kit.eu/en/knowledge/gdpr-complete-package-austria) — Austria's NISG 2026 is a separate cybersecurity-incident reporting regime, distinct from GDPR breach notification, in force from 1 October 2026. - [European Data Protection Board](https://www.edpb.europa.eu/news/edpb-publishes-statement-on-the-data-protection-challenges-of-smart-glasses_en) — Datenschutzbehörde (DSB) — 2026 budget of EUR 5.9 million, reduced from EUR 6.1 million in 2025, with approximately 53-70 staff. - [Datenschutzbehörde (DSB)](https://dsb.gv.at/aktuelles/aktuelles) — Datenschutzgesetz (DSG) §1 — Guarantees a fundamental right to data protection for natural and legal persons since 1978; a 2018 repeal attempt failed in parliament. - [https://cms.law/en/alb/publications/gdpr-enforcement-tracker-report/austria](https://cms.law/en/alb/publications/gdpr-enforcement-tracker-report/austria) — Datenschutzbehörde (DSB) — Austria's sole national supervisory authority under Article 51 GDPR, ~70 staff, 2026 budget ~EUR 5.9m (down from EUR 6.1m in 2025). - [https://www.recordinglaw.com/de/world-laws/world-data-privacy-laws/austria-data-privacy-laws/](https://www.recordinglaw.com/de/world-laws/world-data-privacy-laws/austria-data-privacy-laws/) — Datenschutzgesetz (DSG) s.1 — Constitutional rank since 1978, guaranteeing a fundamental right to data protection for natural and legal persons; a 2018 repeal attempt failed. - [CMS GDPR Enforcement Tracker Report — Austria](https://cms.law/en/int/publication/GDPR-Enforcement-Tracker-Report/austria) — Datenschutzbehörde (DSB) — DSB is a federal authority with ~70 employees and a EUR 5.9 million 2026 budget (down from EUR 6.1 million in 2025). - [Multilaw Data Protection Guide — Austria](https://www.multilaw.com/Multilaw/Multilaw/Data_Protection_Laws_Guide/DataProtection_Guide_Austria.aspx) — Austria GDPR/DSG framework — Austria applies the GDPR together with the national Datenschutzgesetz (DSG); the DSB is the single supervisory authority nationwide, unlike Germany's federated Länder-DPA model. - Primary statutory record — Datenschutzbehörde (DSB) — single national DPA, competence for whole of Austria - [Compliance Kit](https://compliance-kit.eu/en/knowledge/gdpr-complete-package-austria) — NISG 2026 (Network and Information Systems Security Act 2026) — in force from 1 October 2026, addressed to CSIRT not the DSB - [Datenschutzbehörde (DSB)](https://dsb.gv.at/aktuelles/aktuelles) — Datenschutzbehörde (DSB) — The DSB's own public bekanntmachungen feed, checked directly for the window 2026-10-11 to 2026-10-18, shows no new Austria-specific decision, fine or instrument dated in that window beyond bilateral-meeting and EU-level-reference notices. ### Austria: D2 Lawful Processing & Special Data4 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Directly-applicable GDPR core with a narrow, well-documented national research-safeguards overlay; no material derogation gaps identified. Primary framework GDPR Arts 6, 7, 9; DSG §7 (research safeguards) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Green Directly-applicable GDPR core with a narrow, well-documented national research-safeguards overlay; no material derogation gaps identified. D2 · Lawful Processing — Full Module Record 4 sub-modules · 44 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D3 Data Subject Rights5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Core rights are directly enforced by the DSB with a developed body of national and CJEU case law; no material national restriction identified. Primary framework GDPR Arts 15-22; DSG §24 (complaints procedure) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Green Core rights are directly enforced by the DSB with a developed body of national and CJEU case law; no material national restriction identified. #### Sub-modules (5) #### Access RightGreen GDPR Art 15 access right applies directly; CJEU C-416/23 clarifies the 'excessive requests' fee/refusal discretion under Art 57(4) GDPR as applied by the DSB. Claims (2): - The CJEU held in Case C-416/23 that a supervisory authority faced with 'excessive' requests within Article 57(4) GDPR must show the requests were both repeated/frequent and manifestly vexatious or abusive before charging a fee or refusing to act, constraining the DSB's discretion in access-right complaints. - Datenschutzbehörde (DSB) — Following CJEU ruling C-416/23 (January 2025), the DSB cannot limit the number of complaints a data subject may file per month, provided the complaints are not genuinely abusive. #### Rectification And ErasureAmber DSB balances erasure requests against overriding legitimate/public interests, e.g. commercial-register transparency. Claims (1): - In a 2025 decision the DSB held that publicly available Austrian commercial-register data identifying a company's legal representative need not be erased where the general public interest in transparency of representative authority outweighs the data subject's Article 17 erasure interest. #### Restriction And ObjectionGreen GDPR Arts 18/21 restriction and objection rights apply directly, including the requirement of compelling overriding legitimate grounds to continue processing after an objection. Claims (1): - Under GDPR Article 21(1) as applied by the DSB, a controller may continue processing following an objection only where it demonstrates compelling legitimate grounds overriding the data subject's interests, rights and freedoms. #### Data PortabilityGreen DSB practice treats delivery of data in a structured, machine-readable format directly to the complainant as satisfying Art 20 portability and can lead to amicable case closure. Claims (1): - The DSB treats a controller's delivery of the complainant's personal data in a structured, commonly used, machine-readable (e.g. CSV/Excel) format directly to the data subject as satisfying the Article 20 GDPR portability right, permitting the complaint to be closed as amicably settled under §24(6) DSG. #### Deadlines And Response WindowsGreen The GDPR's one-month (extendable to three-month) response deadline applies; DSB enforcement treats prolonged non-response as an actionable infringement. Claims (1): - DSB enforcement practice treats a controller's failure to respond to a data-subject portability/access request for more than a month, despite reminders, as an actionable non-compliance with GDPR response deadlines. GDPR Articles 15-22 apply directly in Austria; DSB enforcement decisions and CJEU references (notably Case C-416/23 on 'excessive requests' and various DSB portability/erasure/access decisions) illustrate concrete national application, including the balancing of erasure requests against public-register transparency interests and the treatment of structured-format data delivery as satisfying portability. No new data since the standing brief. 1 periodic run re-emitted it unchanged. Sources and claims (6) - [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX%3A62023CJ0416) — The CJEU held in Case C-416/23 that a supervisory authority faced with 'excessive' requests within Article 57(4) GDPR must show the requests were both repeated/frequent and manifestly vexatious or abusive before charging a fee or refusing to act, constraining the DSB's discretion in access-right complaints. - [EDPB](https://www.edpb.europa.eu/system/files/2025-08/at-2025-decision-public.pdf) — In a 2025 decision the DSB held that publicly available Austrian commercial-register data identifying a company's legal representative need not be erased where the general public interest in transparency of representative authority outweighs the data subject's Article 17 erasure interest. - [EDPB](https://www.edpb.europa.eu/system/files/2025-08/at-2025-decision-public.pdf) — Under GDPR Article 21(1) as applied by the DSB, a controller may continue processing following an objection only where it demonstrates compelling legitimate grounds overriding the data subject's interests, rights and freedoms. - [EDPB](https://www.edpb.europa.eu/system/files/2025-01/decision-714.pdf) — The DSB treats a controller's delivery of the complainant's personal data in a structured, commonly used, machine-readable (e.g. CSV/Excel) format directly to the data subject as satisfying the Article 20 GDPR portability right, permitting the complaint to be closed as amicably settled under §24(6) DSG. - [EDPB](https://www.edpb.europa.eu/system/files/2025-01/decision-714.pdf) — DSB enforcement practice treats a controller's failure to respond to a data-subject portability/access request for more than a month, despite reminders, as an actionable non-compliance with GDPR response deadlines. - [Datenschutzbehörde (DSB)](https://dsb.gv.at/aktuelles/aktuelles) — Datenschutzbehörde (DSB) — Following CJEU ruling C-416/23 (January 2025), the DSB cannot limit the number of complaints a data subject may file per month, provided the complaints are not genuinely abusive. ### Austria: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core accountability obligations are GDPR-direct and green, but granular Austria-specific implementation detail (DPIA lists, sectoral retention rules) could not be independently confirmed this pass, warranting amber pending further primary-source verification. Primary framework GDPR Arts 5, 25, 28, 30, 32-39 Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber Core accountability obligations are GDPR-direct and green, but granular Austria-specific implementation detail (DPIA lists, sectoral retention rules) could not be independently confirmed this pass, warranting amber pending further primary-source verification. Periodic update · new data 2026-10-11 #### Controller/Processor Duties The same VwGH judgment that resolved the Article 9(1) special-category question (Ro 2025/04/0007, 24 June 2026) also narrowed how documentation-based aggravating factors should be assessed under Austrian GDPR enforcement practice. The lower court had treated certain DPIA (data protection impact assessment) and ROPA (records-of-processing-activities) documentation deficiencies as an aggravating factor in setting the original €16,000,000 fine against Österreichische Post AG. The VwGH found that these particular documentation deficiencies were themselves derivative of — that is, a downstream consequence of — an earlier legal mis-classification of the processing activity, rather than independent, freestanding compliance failures. On that basis, the court discontinued the separate aggravating-factor findings tied to those documentation deficiencies and recalculated the fine down to €13,000,000 plus €100,000 costs. This is a confirmed-confidence finding sourced to the Datenschutzbehörde's own notice, a Tier-1 source. The practical significance of this holding for controller/processor accountability obligations in Austria is that a DPIA or ROPA deficiency which traces back to a single upstream classification error should not necessarily be double-counted as an additional, independent aggravating factor in fine calculation. Where a controller mis-classifies a processing activity at the outset — for example, failing to recognise that an activity involves special-category data — the documentation gaps that follow from that mis-classification (an incomplete DPIA that did not address the special-category dimension, for instance) are treated by the VwGH as a consequence of the root error rather than as separately punishable accountability failures layered on top of it. This narrowing does not relax the underlying substantive obligation to conduct an adequate DPIA or maintain an adequate ROPA; it addresses only how documentation gaps traceable to a single upstream classification error should be weighted in fine calculation, as distinct from documentation gaps that are genuinely independent of any classification question. #### Outlook Austrian controllers facing DSB or VwGH scrutiny of multiple compliance failings arising from a single root-cause classification error now have a binding precedent for arguing against double-counting of derivative documentation deficiencies as independent aggravating factors. Future cases will likely test the boundary of this holding — specifically, how clearly a documentation deficiency must trace back to an upstream classification error before a court will treat it as derivative rather than independent. Periodic update · new data 2026-09-28 #### Controller/Processor Duties The DSB's controller/processor scrutiny this cycle is understood to centre on decision D135.027, which examines cookie-banner design and transparency practices alongside Microsoft 365 Education deployments in Austrian schools, including the third-country data-flow dimensions of those deployments. This is a Probable finding sourced from a T3 enforcement-tracker publication, and it is presented here as an active regulatory examination rather than a concluded, binding decision - the underlying claim carries is_binding: false, meaning it should be read as scrutiny in progress rather than a settled finding against a named controller. The examination's dual focus - cookie-banner transparency on the one hand, education-sector cloud deployments on the other - illustrates the DSB's current controller/processor priorities: consent-interface adequacy for commercial websites, and third-country data-flow exposure for institutional deployments of major cloud-service providers. Both threads sit within the DSB's ordinary Article 51 GDPR supervisory remit; neither has been confirmed this cycle as having produced a final sanction or corrective order. No further controller/processor developments - security-measure enforcement actions, DPIA-adequacy findings, or processor-agreement disputes - were located for Austria this cycle beyond the D135.027 examination. #### Outlook Whether the D135.027 examination concludes with a binding corrective order, and if so what it requires of cookie-banner design or of Microsoft 365 Education deployments specifically, is the concrete item to watch. Given the DSB's broader enforcement-capacity constraints reported elsewhere this cycle, the pace at which this examination resolves is itself a signal worth tracking. D4 · Controller & Processor — Full Module Record 7 sub-modules · 61 words · 11 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D5 Cross-Border & Adequacy6 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Fully harmonised EU Chapter V transfer regime with no identified Austria-specific derogation or localisation mandate. Primary framework GDPR Arts 44-49 (Chapter V) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Green Fully harmonised EU Chapter V transfer regime with no identified Austria-specific derogation or localisation mandate. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 55 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Green), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Two of seven sub-modules (telecoms/ePrivacy, employment) are evidenced; five require further primary-source escalation. Primary framework TKG 2021 (Telecommunications Act); Arbeitsverfassungsgesetz (ArbVG); GlBG; GDPR/DSG Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber Two of seven sub-modules (telecoms/ePrivacy, employment) are evidenced; five require further primary-source escalation. Periodic update · new data 2026-10-25 #### Sectoral Watch Austria's data protection authority is reported to have found that KSV1870's fully automated credit-scoring process, which formed the basis for a credit decision taken by energy supplier Unsere Wasserkraft, constituted an impermissible automated individual decision under Article 22 of the General Data Protection Regulation. Both KSV1870 and Unsere Wasserkraft are reported to have also fallen short of their transparency obligations to the individual affected. This account is drawn from a secondary legal-guide summary rather than the authority's own published decision, so the exact date of the finding, and whether it is final or being appealed, are not yet established. #### Outlook Confirmation through the authority's own published decision would clarify both the date and procedural status of this finding. If confirmed, it would stand as a concrete application of the Article 22 automated-decision-making prohibition to a commercial credit-scoring arrangement in Austria, relevant to any business using automated scoring as a basis for decisions that produce legal or similarly significant effects for individuals. Periodic update · new data 2026-10-05 #### Sectoral Watch The EU Data Act, Regulation (EU) 2023/2854, became directly applicable in Austria on 12 September 2025. As a directly applicable EU regulation, it required no national transposition act to take legal effect, in contrast to a directive. Despite that direct applicability, no Austria-specific national measure formally designating the competent authority or data coordinator responsible for Data Act enforcement has been located as of this cycle. Commentary reviewed this cycle responds to that gap by directing businesses to monitor Austria's official legal-information portal, RIS, and the Datenschutzbehörde in the interim, which suggests that, pending formal designation, the DSB may be the default point of contact for Data Act matters in practice even without a formal competent-authority designation having been enacted. This is a meaningful institutional gap. The Data Act establishes obligations around data access and sharing, including rights for users of connected products to access data those products generate and obligations on data holders to make such data available under specified conditions. Enforcement of these obligations ordinarily depends on a functioning national competent-authority structure with investigative and sanctioning powers. Without a formally designated authority, the practical enforceability of Data Act obligations in Austria rests on an unclear institutional foundation, even though the underlying substantive obligations are already in force by virtue of the regulation's direct applicability. The gap also raises a practical question for in-scope businesses, data holders and data recipients subject to the Data Act's access and sharing obligations: absent a clearly designated enforcement body, it is not established on the evidence available this cycle where a complaint about non-compliance with Data Act obligations in Austria would currently be lodged, beyond the general direction toward the DSB offered by secondary commentary. This uncertainty sits in some tension with the broader trajectory of Austria's data-protection and digital-regulation architecture, which elsewhere this cycle (in enforcement and in AI-governance matters) shows active institutional movement, whereas the Data Act competent-authority question appears comparatively dormant. No information located this cycle indicates whether a legislative process to designate a Data Act competent authority is underway in Austria, whether such a process has been announced, or what timetable might apply. The absence of a located designation does not establish that no process exists; it establishes only that none was identified in the sources reviewed this cycle. #### Outlook The central open question for Austria's sectoral data-regulation watch is whether and when a national competent authority or data coordinator will be formally designated for EU Data Act enforcement purposes. Until that designation occurs, businesses operating in Austria that are subject to Data Act obligations should expect to rely on general guidance directing them toward RIS and the Datenschutzbehörde, rather than a clearly empowered sector-specific enforcement body. Developments on this question would represent a material change to Austria's sectoral-watch posture and should be monitored closely in subsequent cycles. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 51 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D7 AdTech & Commercial Privacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Cookie/tracker and direct-marketing sub-modules are evidenced; opt-out-signal, clean-room, and cross-context-advertising sub-modules do not map cleanly onto the EU consent-based model and were not independently confirmed as distinct Austrian constructs. Primary framework TKG 2021 (implementing ePrivacy Directive Art 5(3)); GDPR Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber Cookie/tracker and direct-marketing sub-modules are evidenced; opt-out-signal, clean-room, and cross-context-advertising sub-modules do not map cleanly onto the EU consent-based model and were not independently confirmed as distinct Austrian constructs. Periodic update · new data 2026-09-28 #### AdTech & Commercial Privacy The DSB is understood to hold a strict interpretive position on analytics cookies: that they cannot in any case be considered technically necessary for the operation of a website, meaning opt-in consent is required for their use regardless of the specific analytics purpose claimed. This is an Uncertain-confidence finding, sourced from a single T4 vendor commentary this cycle, and it has not been independently corroborated against a DSB decision or guidance document with a specific citation. This Austrian position stands in some tension with the European Commission's proposed Digital Omnibus. Reports suggest that if the Digital Omnibus is adopted as a directly-applicable EU Regulation, it would create an EU-level cookie-consent exemption that would override Austria's stricter national position without requiring national transposition - a structurally significant possibility given the direct-applicability mechanism involved. However, adoption of the Digital Omnibus in this form is considered unlikely before mid-2027, meaning any such override remains a multi-year prospect rather than a near-term one. The practical consequence for Austrian-facing commercial websites and adtech operators today is that the DSB's strict opt-in position remains the operative standard; no relaxation has occurred and none is imminent this cycle. #### Outlook The Digital Omnibus's legislative progress - and specifically whether it retains the cookie-consent exemption in a form that would apply directly to Austria without transposition - is the structural item to watch over the coming one to two years, with adoption considered unlikely before mid-2027. In the interim, the DSB's strict opt-in position for analytics cookies remains the binding practical standard for Austrian-facing operators. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 52 words · 8 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Profiling/ADM and state-surveillance carve-out sub-modules are GDPR/CJEU-evidenced (green); AI-risk-assessment sub-module is evidenced but time-sensitive/in-transition (amber); biometric and genetic sub-modules lack confirmed Austria-specific overlay (red-leaning amber). Primary framework GDPR Art 22; EU AI Act (Regulation (EU) 2024/1689) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber Profiling/ADM and state-surveillance carve-out sub-modules are GDPR/CJEU-evidenced (green); AI-risk-assessment sub-module is evidenced but time-sensitive/in-transition (amber); biometric and genetic sub-modules lack confirmed Austria-specific overlay (red-leaning amber). Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance The European Data Protection Board adopted Statement 1/2026 on the data protection challenges of smart glasses on 13 October 2026. The statement sets out the Board's preliminary thinking on a question that sits at the intersection of biometric data processing, surveillance governance, and AI-linked device functionality: smart glasses, by their nature, can capture images, video, and potentially biometric data about bystanders who are not the device wearer and who have not consented to being recorded. The statement considers how GDPR responsibility for this bystander data may be allocated among the device manufacturer, the provider of a linked artificial-intelligence or application service that processes the captured data, and the wearer who operates the device in a given context, with the appropriate allocation depending on the specific use case and the respective roles each party plays in determining the purposes and means of processing. It is important to characterise the statement accurately: it is preliminary, non-binding guidance from the EDPB. It has no formal public consultation process attached, and it names no specific company, product, or device model. This distinguishes it from a binding regulatory instrument, a draft legislative proposal, or a guidance document that has gone through the EDPB's standard consultation procedures; at this stage, it functions as an articulation of the Board's thinking on an emerging technology category rather than as settled or enforceable guidance. For Austria, the statement's relevance runs through the Datenschutzbehörde's (DSB) membership of the EDPB rather than through any separate Austrian instrument. The statement was referenced on the DSB's own public announcement feed by 15 October 2026, confirming that the Austrian authority is tracking the development, but the DSB has not, within the window checked this cycle, issued its own national-level guidance, opened an inquiry, or otherwise responded to the statement with a distinct Austrian regulatory action. The DSB's own bekanntmachungen feed, checked directly for the period from 11 to 18 October 2026, shows no new Austria-specific decision, fine, or instrument dated in that window beyond notices of this kind referencing bilateral meetings or EU-level developments. The significance of this development for Austria is accordingly structural rather than immediate: it signals that a question relevant to a growing category of consumer AI-linked wearable devices is now on the EDPB's active agenda, which, given the DSB's membership and participation in EDPB processes, is likely to inform how the DSB itself approaches any future Austria-specific smart-glasses or similar wearable-device matter that may arise, without yet constituting a binding standard the DSB or any other Austrian body is applying today. #### Outlook Whether the DSB will move beyond tracking the EDPB statement to open a national-level inquiry or issue its own guidance addressing smart glasses or comparable AI-linked wearable devices in the Austrian market is not stated in the sources reached this cycle. The EDPB statement's current non-binding, pre-consultation status means its practical effect on Austrian controllers and processors remains prospective rather than immediate; the clearest signal to watch for in subsequent cycles is whether the EDPB moves the statement toward a formal consultation process, or whether the DSB issues any national-level follow-up referencing the statement directly. Periodic update · new data 2026-10-11 #### Algorithmic, Biometric & Surveillance Governance Austria's institutional architecture for AI Act implementation remains unsettled on a key structural point this cycle. Austria has not completed designation of its Article 70 national competent authority under the EU AI Act, having missed the 2 August 2025 deadline for doing so. In the interim, the Austrian Regulatory Authority for Broadcasting and Telecommunications' KI-Servicestelle operates as an advisory body rather than as the formally designated competent authority. This is a probable-confidence finding, and the sources reviewed this cycle disagree on whether a formal designation has since occurred — that disagreement is recorded as genuinely unresolved rather than settled by preferring one source's characterisation over another's. Separately, reports attribute to the Datenschutzbehörde (DSB) a claimed market-surveillance competence over high-risk AI systems used for biometric identification in the law-enforcement context, a category falling under the AI Act's Annex III point 1 high-risk classification. This is an uncertain-confidence finding: no DSB primary statement was located and directly cited this cycle confirming the DSB's own position on this point, and the characterisation rests on a third-party aggregator source rather than the regulator's own publication. Taken together, these two findings describe an institutional landscape still in formation: the overarching Article 70 competent-authority question remains open, while at the same time a specific sectoral competence claim — DSB market surveillance over law-enforcement biometric AI — is being reported even though the broader designation question it would logically sit within has not been definitively confirmed as resolved. This is the kind of institutional-architecture gap where the practical allocation of regulatory competence on the ground may be outpacing, or operating independently of, the formal designation process. #### Outlook Resolving whether Austria has completed Article 70 designation beyond the KI-Servicestelle's current advisory status is the clearest open item, and doing so will require identifying a primary Austrian government or RTR source rather than relying on the conflicting secondary characterisations available this cycle. Equally, confirming the DSB's own stated position on its market-surveillance competence over law-enforcement biometric AI systems, directly from the DSB rather than through an aggregator's characterisation, would meaningfully strengthen confidence in that specific finding. Periodic update · new data 2026-10-05 #### Algorithmic, Biometric & Surveillance Governance Austria is understood to have missed the 2 August 2025 deadline under Article 70 of the EU AI Act to designate a national competent authority responsible for implementing and enforcing the Act's obligations. As of mid-2026, the only body in existence addressing this function is the KI-Servicestelle, an advisory body housed at RTR-GmbH (the Austrian regulatory authority for broadcasting and telecommunications). No enacted timetable for converting the KI-Servicestelle into a fully empowered national competent authority with investigative and sanctioning powers has been identified in the sources reviewed this cycle. The significance of this gap is structural rather than merely administrative. The AI Act's substantive obligations, including requirements around risk assessment for high-risk AI systems, are already enforceable in Austria by virtue of the Act's own commencement timetable, independent of whether Austria has completed its own national competent-authority designation. This creates an asymmetry: obligated parties operating AI systems in Austria face in-force substantive requirements without a clearly empowered national body positioned to enforce them, investigate non-compliance, or provide authoritative guidance on contested questions of application. This is a live governance gap, not a resolved or stable baseline, and it is reported as an escalating rather than static concern, reflecting that time has continued to pass since the missed August 2025 deadline without resolution. The KI-Servicestelle's advisory-only status means that, for now, affected businesses and individuals seeking authoritative rulings on AI Act compliance questions in Austria lack an empowered venue for doing so at the national level. Whether complaints or compliance questions are in practice being routed to the Datenschutzbehörde, to sectoral regulators, or are simply unresolved at the national level is not established on the evidence available this cycle. This gap should be read alongside Austria's otherwise active enforcement posture in adjacent governance domains this cycle, including the confirmed Austrian Postal Service fine for unlawful profiling. That contrast underscores that Austria's institutional gap in AI Act governance is not a function of general regulatory inactivity, but appears specific to the AI Act competent-authority designation process itself. No information located this cycle indicates when, or whether, Austria intends to formally empower the KI-Servicestelle or designate an alternative body as the national competent authority under Article 70. The absence of a located timetable does not establish that none exists internally within Austrian government planning; it establishes only that none was identified in the sources reviewed this cycle. #### Outlook The central open question for Austria's algorithmic and surveillance-governance posture is whether and when the KI-Servicestelle will be converted into, or replaced by, a fully empowered AI Act national competent authority. Until that occurs, the enforcement gap between the AI Act's already-binding substantive obligations and Austria's incomplete institutional architecture for enforcing them will persist. This is a governance question to monitor closely, since any enacted timetable for NCA conversion, or any indication that enforcement activity is nonetheless occurring through an alternative institutional route, would represent a material development. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 82 words · 12 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ The EU-level Article 8 framework is confirmed, but the Austria-specific numerical age-of-consent threshold and several sub-modules were not independently verified in this pass, warranting escalation to primary source (RIS/DSG text) before publication reliance. Primary framework GDPR Art 8; DSG (national age-of-consent implementation — threshold unconfirmed this pass) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber The EU-level Article 8 framework is confirmed, but the Austria-specific numerical age-of-consent threshold and several sub-modules were not independently verified in this pass, warranting escalation to primary source (RIS/DSG text) before publication reliance. D9 · Children's Privacy — Full Module Record 5 sub-modules · 74 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Austria: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Core enforcement powers, penalty ceilings, and a significant recent CJEU judgment are well-evidenced (green-leaning); current regulator funding/capacity and collective-redress implementing-act specifics were not independently confirmed this pass (amber). Primary framework GDPR Arts 58, 77-84; DSG §24 (complaints procedure) Supervisory authority [Österreichische Datenschutzbehörde (DSB)](https://www.dsb.gv.at/) Traffic-light rationale — Amber Core enforcement powers, penalty ceilings, and a significant recent CJEU judgment are well-evidenced (green-leaning); current regulator funding/capacity and collective-redress implementing-act specifics were not independently confirmed this pass (amber). Periodic update · new data 2026-11-04 #### Enforcement & Redress The standing position on penalty powers is unchanged: the Datenschutzbehörde may impose GDPR administrative fines of up to EUR 20 million or 4% of worldwide annual turnover, alongside separate national fines of up to EUR 50,000 under Austrian law, according to secondary legal commentary reviewed. What has moved is the resourcing behind that power. Reporting places the authority's 2026 budget at approximately EUR 5.9 million, a reduction from around EUR 6.1 million in 2025, with roughly 53 permanent staff in post. The same reporting states this reduction has coincided with a reported shift away from proactive, authority-initiated investigations toward a complaint-driven enforcement model, a shift framed against a reported 769% increase in complaint volume since 2017. Taken together, the picture is one of a widening mismatch between caseload and capacity rather than any change to the legal basis for enforcement itself. An aggregator figure puts 2026-to-date enforcement activity at around 17 actions totalling approximately EUR 6,000 in fines, a markedly lower pace than the authority's cumulative record since inception of roughly 201 actions and approximately EUR 42.5 million. That contrast is consistent with a capacity-driven slowdown, but the figure comes from a secondary aggregator rather than the regulator's own annual activity report, and has not been independently confirmed against primary documentation. The same caution applies to two adjacent items noted only in passing: reports describing a Datenschutzbehörde finding against a major social-media tracking pixel under the reasoning line previously applied to analytics tools, and a separate reported finding against a facial-recognition database operator for scraping Austrian residents' images. Both rest on secondary reporting only, with no primary decision text reviewed, and are noted here solely as part of the authority's reported enforcement record rather than as confirmed new rulings. #### Outlook The material question going forward is whether the reported budget contraction and the reported move toward complaint-driven casework persist or deepen. If the secondary reporting proves accurate, the practical effect of Austria's enforcement framework in 2027 could diverge materially from its nominal statutory strength, with fewer authority-initiated inquiries even as complaint volumes continue to climb. Confirmation of the current-year enforcement tally and the exact budget figure against the Datenschutzbehörde's own primary reporting would sharpen this picture considerably; until that is available, the capacity constraint should be treated as a reported trend to monitor rather than a settled fact. Periodic update · new data 2026-10-25 #### Enforcement & Redress The Datenschutzbehörde's 2025 activity report states that the number of its decisions published in the federal legal information system (RIS) rose from nineteen in 2024 to sixty-seven in 2025. The authority attributes this increase to the entry into force of the Informationsfreiheitsgesetz, Austria's freedom-of-information law. This is drawn directly from the authority's own annual report. The increase is a change in the visibility of the authority's decision-making rather than a change in its substantive enforcement standards or the underlying obligations that apply to controllers and processors in Austria. More than tripling the volume of published decisions nonetheless materially improves the ability of practitioners and affected individuals to observe how the authority is applying the law in practice. #### Outlook If the pace of publication continues at or near the 2025 level, Austria's enforcement record will become substantially more transparent and easier to track over time than it has historically been, which should make emerging patterns in the Datenschutzbehörde's decision-making more visible going forward. Periodic update · new data 2026-10-11 #### Enforcement & Redress The VwGH's final judgment in Ro 2025/04/0007, issued 24 June 2026, is the defining enforcement development of this cycle. The court confirmed Österreichische Post AG's unlawful processing, under Article 9(1) GDPR, of statistically-derived "party-affinity" data for approximately 2.2 million individuals, and fixed a combined fine of €13,000,000 plus €100,000 costs. This is now Austria's largest confirmed GDPR fine, confirmed-confidence and sourced to both the Datenschutzbehörde's own notice and the VwGH's own media release. The judgment's path to finality is itself notable for enforcement and redress purposes: the fine was reduced from the lower court's €16,000,000 after the VwGH found that certain documentation-deficiency findings treated as aggravating factors below were in fact derivative of an earlier legal mis-classification of the processing activity (addressed in detail under Controller/Processor Duties), and discontinued those separate findings. The case therefore illustrates the full Austrian appellate pathway for a major GDPR enforcement action — from DSB investigation and initial penalty, through lower-court review, to a final VwGH determination that both substantively confirmed the core unlawfulness finding and recalibrated the penalty calculation on a narrower legal basis. For context on enforcement capacity more broadly, the Datenschutzbehörde operated in 2026 with a budget of approximately €5.9 million, down from €6.1 million in 2025, and approximately 58 staff as of end-2025, serving a population of approximately 9 million. This is a probable-confidence finding from a single secondary source, included here as relevant background to the DSB's enforcement capacity even though it was not independently re-verified against a primary DSB budget disclosure this cycle. #### Outlook The Österreichische Post judgment, now final, establishes Austria's highest-value confirmed GDPR fine and a significant precedent on both the scope of Article 9(1) and the treatment of derivative documentation deficiencies in fine calculation. Future Austrian enforcement actions involving profiling or scoring activity with a plausible special-category dimension are likely to be assessed against this precedent, and the DSB's resourcing level — essentially flat to slightly declining in nominal terms year-on-year — is a relevant structural factor in assessing the regulator's capacity to pursue further large-scale investigations of comparable complexity. Periodic update · new data 2026-10-05 #### Enforcement & Redress Austria's most significant GDPR enforcement precedent reached a point of substantial closure this cycle. The Verwaltungsgerichtshof, Austria's highest ordinary administrative court, confirmed in a decision reported in July 2026 a EUR 16 million GDPR fine against the Austrian Postal Service. The confirmed fine concerns two distinct categories of unlawful processing: the unlawful creation and commercial use of inferred political-preference profiles, and the unlawful processing of parcel-frequency data for marketing purposes. The case traces back to the Datenschutzbehörde's original fine of EUR 18 million imposed in October 2019, meaning the confirmed figure represents a reduction from the original penalty over the course of litigation, and the confirmation now closes nearly seven years of legal process. The significance of this confirmation extends beyond the specific penalty amount. It is reported as Austria's largest and most significant GDPR enforcement case, and its confirmation by the country's highest ordinary administrative court removes a substantial layer of legal uncertainty that had persisted since the DSB's original 2019 decision. For other controllers in Austria engaged in similar profiling or inferred-characteristic processing for marketing purposes, the confirmed decision now stands as binding precedent on the lawfulness of such practices, at the level of Austria's highest ordinary administrative court. That said, the case may not be fully and finally closed. Some secondary sources reviewed this cycle report that a complaint to the Verfassungsgerichtshof, Austria's constitutional court, remains pending. If accurate, this would mean the Verwaltungsgerichtshof's confirmation, while authoritative at the ordinary-administrative-court level, is not necessarily the final word on the case; a successful constitutional complaint could in principle still alter the outcome. This qualification is reported with lower certainty than the confirmation itself, and whether the Verfassungsgerichtshof complaint is in fact still active, and on what grounds, is not established on the evidence available this cycle. The nearly seven-year duration of this litigation, from the DSB's October 2019 original decision to the Verwaltungsgerichtshof's confirmation reported in July 2026, illustrates the extended timelines that can attach to large GDPR enforcement actions that are contested through Austria's full administrative court hierarchy. This has implications for how other pending or future large enforcement actions in Austria might be expected to proceed if challenged: controllers facing substantial DSB fines may pursue multi-year litigation paths before a final, uncontested resolution is reached. #### Outlook The principal open question for Austria's enforcement and redress posture is whether the reported pending Verfassungsgerichtshof complaint against the Austrian Postal Service decision is genuinely still active, and if so, what outcome it might produce. Until that question is resolved, or until it becomes clear no such complaint remains pending, the Verwaltungsgerichtshof's July 2026 confirmation should be treated as the current but not necessarily final state of Austria's largest GDPR enforcement case. Any further development in this litigation, whether confirming finality or reopening the matter, would be a material development for Austria's enforcement and redress record. Periodic update · new data 2026-09-28 #### Enforcement & Redress Austria's enforcement-and-redress picture this cycle combines a documented low conversion rate from complaint to sanction with a contracting regulatory budget. The DSB is understood to have conducted 4,030 proceedings in 2023 - comprising 2,389 national proceedings, 876 cross-border proceedings, and 765 proceedings initiated ex officio - of which only 55 resulted in fines, a 1.36 percent rate that noyb founder Max Schrems has publicly criticised. This is a Probable finding sourced from noyb, a T2 source, and it is the clearest quantitative enforcement-capacity signal available for Austria this cycle. That enforcement-rate finding sits alongside the DSB's 2026 budget of approximately EUR 5.9 million, down from EUR 6.1 million in 2025 - a real-terms contraction for the sole national supervisory authority under Article 51 GDPR, which operates with approximately 70 staff. One 2026 commentary, sourced from a single uncorroborated T4 source, reports that this budget constraint has forced the DSB to stop proactive investigations entirely; this claim is presented here as reported rather than confirmed, given its single-source, lower-tier basis. The DSB's enforcement powers themselves remain broad on paper: it may order cessation of unlawful processing and impose GDPR fines of up to EUR 20 million or 4 percent of global turnover, plus DSG-specific fines of up to EUR 50,000 for CCTV and data-secrecy violations. Separately, noyb has held status as a Qualified Entity under the EU Representative Actions Directive since December 2024, enabling it to bring EU-wide representative proceedings on behalf of data subjects - a redress channel operating independently of DSB capacity constraints. Most individual complaints reach the DSB via the Article 77 GDPR direct-complaint mechanism, which is reported to drive the majority of the authority's enforcement activity. The ongoing Österreichische Post fine litigation illustrates both the DSB's enforcement reach and the current uncertainty in its outcomes: the Constitutional Court declined the underlying complaint on 9 December 2025, but the settled fine quantum remains disputed, with one account citing a 24 June 2026 Administrative High Court figure of EUR 13 million plus EUR 100,000 in costs, against an earlier, still-cited Federal Administrative Court figure of EUR 16 million from December 2024. #### Outlook Whether the DSB's budget trajectory stabilises, and whether the reported halt to proactive investigations is confirmed by further reporting, are the structural enforcement-capacity items to track. On the specific Österreichische Post matter, resolution of the disputed quantum figure is the concrete item outstanding. Separately, Regulation (EU) 2025/2518, introducing additional procedural rules for cross-border GDPR enforcement cooperation, is reported to become applicable around April 2027, which may affect how DSB's cross-border caseload (876 proceedings in 2023) is processed going forward. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 116 words · 25 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 8 [Children & Vulnerable Groups](#sec-cat-children_and_vulnerable_groups) parental consent Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy granted Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties