Austria Data Protection Act 2018 (Datenschutzgesetz - DSG) - GDPR National Implementation

What Austria Data Protection Act 2018 (Datenschutzgesetz - DSG) - GDPR National Implementation requires

Austria's Data Protection Act (Datenschutzgesetz - DSG, Federal Act on the Protection of Natural Persons with Regard to the Processing of Personal Data), as amended by the Datenschutz-Anpassungsgesetz 2018 (Federal Law Gazette I No. 24/2018, published 31 July 2018) to align with the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679), is Austria's primary national data protection legislation. The GDPR is directly applicable Austrian law by virtue of Austria's EU membership. Austria's DSG has a constitutional dimension - the fundamental right to data protection (Grundrecht auf Datenschutz) is established in para. 1 of the DSG, which provides that every natural person has the fundamental right to secrecy of personal data concerning that person, in particular with regard to respect for private and family life, insofar as there is a legitimate interest therein; this constitutional-level protection exists alongside and supplements GDPR rights. Enforcement: Datenschutzbehörde (DSB - Austrian Data Protection Authority) is Austria's independent data protection supervisory authority, headed by the Head of the DSB. The DSB is Austria's representative on the European Data Protection Board (EDPB) and participates in the EDPB's one-stop-shop mechanism for cross-border processing. Austria is notably home to the non-governmental organisation noyb - European Center for Digital Rights (None of Your Business), founded by privacy activist and lawyer Maximilian Schrems, which has filed thousands of GDPR complaints across the EU, resulting in significant enforcement actions coordinated through the DSB and other DPAs. Key Austrian national provisions: (1) Age of digital consent: Austria has set the age of consent for information society services at 14 years (GDPR Art. 8 permits member states to set between 13 and 16); data subjects under 14 require parental or guardian consent; (2) Constitutional fundamental right to data protection - the DSG's para. 1 right is a constitutional-level right enforceable beyond GDPR in Austrian courts; (3) Federal government processing - specific provisions for processing by Austrian federal authorities under Austria's constitutional federal structure; (4) Image processing (Bildverarbeitungsanlagen) - specific Austrian provisions on CCTV and video surveillance systems under the Bildverarbeitungsgesetz (BilschG - Image Processing Act), which provides additional rules beyond GDPR for image processing in public and private spaces; (5) Employment context: Austrian labour law (Arbeitsverfassungsgesetz - ArbVG, Works Constitution Act) provides for works council involvement in employee monitoring decisions; (6) Criminal data - restrictions on private entity processing of criminal conviction data. Fines: GDPR administrative fines apply in Austria - up to EUR 20 million or 4% of global annual turnover for the most serious violations. The DSB has enforced actively and Austria's courts have provided significant GDPR jurisprudence through Constitutional Court (Verfassungsgerichtshof - VfGH) and Administrative Court (Verwaltungsgerichtshof - VwGH) decisions on DSG and GDPR matters.

Pillar: Cybersecurity · Authority: Datenschutzbehörde (DSB - Austrian Data Protection Authority) · Version: 1.0.0 · Last updated: 2026-04-27

Primary source: https://www.dsb.gv.at/

SHA-256 integrity: 2699c1b7fbc1feadd6e14f8404c34583630bc4eb2560807ed36642e1ae398100

Primary Citations — 6 traced to source

• Datenschutzgesetz (DSG, Austria, as amended by Datenschutz-Anpassungsgesetz 2018, BGBl. I Nr. 24/2018) - supplements EU GDPR; para. 1 DSG establishes constitutional-level fundamental right to data protection (Grundrecht auf Datenschutz); national derogations: age of digital consent 14 years; image processing governed additionally by Bildverarbeitungsgesetz (BilschG); works council rights under ArbVG apply to employee monitoring; criminal data restrictions for private entities
• EU GDPR (Regulation (EU) 2016/679) - directly applicable in Austria; fines up to EUR 20 million or 4% of global annual turnover; DSB is Austria's supervisory authority and EDPB member; 72-hour breach notification to DSB under Art. 33; DPIA mandatory for high-risk processing (CCTV, biometric, large-scale) under Art. 35; noyb (European Center for Digital Rights, Austria) has filed thousands of GDPR complaints resulting in enforcement including DSB Google Analytics decision (January 2022)

+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/at-datenschutzgesetz-2018.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/at-datenschutzgesetz-2018.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/at-datenschutzgesetz-2018
• Back to registry: Browse all 10,085 compliance nodes