Austria

The reach comes from Article 3 of the General Data Protection Regulation. The written representative comes from Article 27. The Austrian Data Protection Act (Datenschutzgesetz, DSG) sits on top. It adds national detail rather than a separate test of who is covered. One Austrian layer is broader than the European one. The constitutional right in § 1 DSG reads 'Jedermann hat ... Anspruch auf Geheimhaltung der ihn betreffenden personenbezogenen Daten'. That means everyone has a claim to secrecy of the personal data about them. It is written into the constitution (Verfassungsbestimmung), not ordinary law. So it can only be changed by a two-thirds majority.

Industry by industry, as at 18 August 2026. FINANCE. The Austrian Financial Market Authority (Finanzmarktaufsicht, FMA) publishes its circulars in one place. None of them covers cloud, where you may outsource, or where data may sit. The rules that actually apply are the European Digital Operational Resilience Act, in force since 17 January 2025. They make you name the place where data is used, and hold audit and exit rights. They do not require data to stay in Austria. HEALTH. The Health Telematics Act 2012 (Gesundheitstelematikgesetz 2012), the eHealth Regulation 2025 and the ELGA Regulation 2015 set the rules. Data must travel encrypted, inside dedicated secure health networks. Storage is spread across care providers rather than held centrally. There must be an active treatment relationship before anyone can look. Every access is logged. The ministry's own description states no rule about crossing borders. GOVERNMENT. The federal computing centre (Bundesrechenzentrum) advertises 25,000 terabytes of Austrian storage. It makes no legal claim that data must stay in Austria. We found no binding federal rule on cloud location. TELECOMS. We found no general duty on operators to keep traffic data for law enforcement. Austria's law on keeping that data was struck down by the Constitutional Court in 2014. We could not open an official Austrian source for that, so treat it as medium confidence. EDUCATION, GAMING, DEFENCE and MAPPING. Not checked this time. They are listed as gaps below. Separately, Regulation (EU) 2018/1807 stops Austria requiring non-personal data to stay in the country, except on public-security grounds.

The approved list is populated. It includes the United Kingdom, renewed on 19 December 2025 and running to 2031. It also includes Japan, South Korea, Switzerland, Canada for commercial bodies, and Brazil, added 26 January 2026. The United States is on it only in part. Your recipient must have self-certified under the data privacy arrangement between the European Union and the United States. The 2021 standard contractual clauses are still the set you use, and they have not been amended. The extra clauses promised for importers already caught directly by European law have still not been adopted. The Austrian regulator notes on its own site that an update to the Commission's clauses is planned. The United States route is the unstable one. It is still legally valid today. But the European Data Protection Board wrote formally to the Commission on 31 July 2026. It asked the Commission to examine whether recent changes in the United States affect whether the decision still stands. An appeal against the General Court's dismissal in the Latombe case is also pending. Never make it your only route.

The case is Ro 2025/04/0007-7, decided on 24 June 2026 by the Verwaltungsgerichtshof. The authority is run by one person and is independent. No ministry sits above it. Two Austrian features pull in opposite directions. First, § 11 DSG tells the authority to apply the European penalty list proportionately. For a first breach especially, it should use a warning rather than a fine. That is why Austrian fine counts look low next to Ireland or Spain. Second, § 30(5) DSG says no fine at all may be imposed on authorities, public bodies or public-law corporations. So by law, a large share of Austrian data use carries no fine risk. Austria also leads on doctrine rather than volume. Its authority issued the first European decision holding a website's use of Google Analytics unlawful. We rate it active rather than aggressive. Its output is decisive and now tested in court, but the volume is modest. And the law itself tells the regulator to warn first.

The maximum is the storage-limitation rule in Article 5(1)(e) of the General Data Protection Regulation. It is backed by the erasure right in Article 17. That right expressly steps aside where you need the data to meet a legal duty. The Austrian minimum sits in the Federal Fiscal Code (Bundesabgabenordnung) and the Commercial Code (Unternehmensgesetzbuch). The figure people commonly apply is seven years from the end of the relevant financial year. Property-related records run longer. We could not open the official consolidated text of either law, because the Austrian legal information system blocks automated access. So the seven-year figure is recorded as unconfirmed below, and confidence here is medium. Two Austrian points we did verify. The Data Protection Act itself sets no general minimum for keeping logs for ordinary businesses. And there is no Austrian equivalent of a blanket six-month log-keeping order. Practical rule: never build deletion automation that ignores the accounting minimum. And never treat that minimum as permission to keep the whole customer record.

The 72-hour deadline and the duty to tell affected people come from Articles 33 and 34 of the General Data Protection Regulation. The Austrian regulator restates the deadline on its own site as 'unverzüglich und möglichst binnen 72 Stunden'. The second deadline runs to the Austrian network and information security authority, which is the Ministry of the Interior. You file through the government computer emergency teams at nis.govcert.gv.at, nis.cert.at and nis.energy-cert.at. The official Austrian network security portal does not publish that deadline in hours. So we have not stated one. That is a gap, not a finding. The third deadline is the Digital Operational Resilience Act for financial firms, live since 17 January 2025. It has its own first, interim and final reporting stages. Where one incident starts several deadlines, the shortest one decides what you do in the first hour. The mismatch between them is the single most common operational failure.

(1) AGE FOURTEEN. § 4(4) DSG makes a child's consent to an online service valid once the child has completed their fourteenth year. Austria took the lowest option the European rule allows. So an age gate built for Germany's sixteen will be wrong here, and one built for thirteen will also be wrong. (2) YOU CAN GO TO PRISON. § 63 DSG covers using, disclosing or publishing personal data entrusted to you through your job. It applies where you meant to enrich yourself, or to harm someone's right to secrecy. The penalty is up to one year in prison, or a fine of up to 720 daily income units. It falls on individuals, not the company. (3) THE SECOND FINE. § 62 DSG creates an offence carrying up to 50,000 euros. It covers deliberately breaking the data-secrecy duty, and running image capture against the rules, among other things. Even attempting it is punishable. It applies only where European fines do not, so it is easy to miss. (4) DATA SECRECY IS A CONTRACT DUTY. § 6 DSG makes you bind your staff by contract. They may pass personal data on only when you expressly tell them to. They must keep the data secret even after they leave the job. A standard European supplier agreement does not do this by itself. (5) PUBLIC BODIES CANNOT BE FINED. § 30(5) DSG bars fines against authorities, public bodies acting under a legal mandate, and public-law corporations. Your Austrian government customer carries no fine risk, so it will not share your urgency. The risk lands on you. (6) PARLIAMENT HAS ITS OWN REGULATOR. Complaints about how the Austrian Parliament uses data go to a Parliamentary Data Protection Committee, not to the Data Protection Authority. (7) SURVEILLANCE CAMERAS. Austria keeps its own image rules in §§ 12 and 13 DSG, on top of European law. They include specific security and signage duties.

PENDING COURT CASE. Sixty-seven members of the Austrian Parliament challenged § 11(1)(9) of the State Protection and Intelligence Service Act (Staatsschutz- und Nachrichtendienst-Gesetz), introduced in July 2025. It lets the state read encrypted messages by installing software on a target's computer system. The case is G 13-14/2026 and the hearing was held on 22 June 2026. Austria's Constitutional Court struck down the earlier version of this power in 2019. So a second annulment is a real possibility. A rule that binds today could stop binding overnight. NIS2 STILL MISSING. As at 18 August 2026 the Austrian government's own network security portal still describes the national law as implementing the 2016 directive. It says the existing rules 'require adaptation' for the newer one. The deadline to write it into national law was 17 October 2024. When it lands, it will sharply widen to manufacturing, food, waste, postal services and digital providers. Registration windows in other member states have been short. POWERS ALREADY HELD. Three matter. The Data Protection Authority can order a company to suspend data flows to a country outside Europe. That usually hurts more than a fine. The government could bring back telecom data retention by ordinary law at any time. And the Freedom of Information Act, in force since 1 September 2025, is only now being tested. Austria's Constitutional Court gave its first rulings on 14 July 2026, including one on a state-owned bank. So expect a widening pool of documents that companies dealing with Austrian public bodies can no longer assume stay private.