Law: Federal Act on the Protection of Individuals With Regard to the Processing of Personal Data (Data Protection Act (DSG) BGBI. I No. 165/1999) (last amended in 2023) (DSG) and the General Data Protection Regulation (Regulation (EU) 2016/679) (GDPR)

Regulator: Austrian data protection authority (DSB)

Summary: In Austria, the DSG implements the GDPR. In particular, both the DSG and the GDPR are applicable in Austria with the DSG complementing the GDPR and tailoring its provisions to the particular national context, providing the legal basis for the structure and powers of the DSB. Notably, the DSG derogates from the GDPR by providing 14 years as the age of valid consent for a child. Importantly, the DSG lays down specific grounds for processing images. Additionally, the DSG requires controllers to get prior approval from the DSB for processing data for scientific or historical research purposes.

The DSB is an active authority and has issued substantial fines, including, for example, a fine of €18 million against the Austrian postal service for violating the GDPR. The DSB and the Austrian Chamber of Commerce (WKO) regularly issue guidance on privacy issues, including data subject access requests, cookies, direct marketing, and the right to be forgotten. The DSB has also issued a list of activities processing activities that are exempt from Data Protection Impact Assessments.

Alongside the GDPR and the DSG, Austria also ratified the Convention for the Protection of Individuals with Regard to Automatic Processing of Personal Data (the Convention 108).