Austria

Reach comes from Article 3 of the General Data Protection Regulation; the written representative comes from Article 27. The Austrian Data Protection Act (Datenschutzgesetz, DSG) sits on top and adds national detail rather than a separate territorial test. One Austrian layer is genuinely broader than the European one: the constitutional right in § 1 DSG is drafted as 'Jedermann hat ... Anspruch auf Geheimhaltung der ihn betreffenden personenbezogenen Daten' — 'everyone has a claim to secrecy of the personal data concerning them' — and it is a constitutional provision (Verfassungsbestimmung), not ordinary law, so it can only be changed by a two-thirds majority.

Sector by sector, as at 18 August 2026. FINANCE: the Austrian Financial Market Authority (Finanzmarktaufsicht, FMA) publishes its circulars in one place and none of them covers cloud, outsourcing location or data storage; the operative regime is the European Digital Operational Resilience Act, applying since 17 January 2025, which forces you to name the location where data is processed and to hold audit and exit rights, but imposes no localisation. HEALTH: the Health Telematics Act 2012 (Gesundheitstelematikgesetz 2012), the eHealth Regulation 2025 and the ELGA Regulation 2015 require encrypted transport inside dedicated secure health networks, storage that is decentralised across care providers, an active treatment relationship before any access, and full access logging — but the ministry's own description states no border rule. GOVERNMENT: the federal computing centre (Bundesrechenzentrum) advertises 25,000 terabytes of Austrian storage but makes no legal residency claim, and we found no binding federal cloud-location rule. TELECOMS: we found no general obligation on operators to retain traffic data for law enforcement; Austria's retention law was annulled by the Constitutional Court in 2014, but we could not open an official Austrian source for that in this run, so treat it as medium confidence. EDUCATION, GAMING, DEFENCE and MAPPING: not verified this run, listed as gaps below. Separately, Regulation (EU) 2018/1807 forbids Austria from imposing localisation on non-personal data except on public-security grounds.

The approved list is populated and includes the United Kingdom (renewed 19 December 2025, running to 2031), Japan, South Korea, Switzerland, Canada for commercial bodies, Brazil (added 26 January 2026), and the United States only for companies self-certified under the EU-US Data Privacy Framework. The 2021 standard contractual clauses remain the operative set and are unamended; the promised extra clauses for importers already directly caught by European law are still not adopted. The Austrian regulator notes on its own site that an update to the Commission's clauses is planned. The United States route is the volatile one: it is still legally valid today, but the European Data Protection Board formally wrote to the Commission on 31 July 2026 asking it to examine whether recent changes in the United States affect the decision's validity, and an appeal against the General Court's dismissal in the Latombe case is pending. Never build on it as your only mechanism.

Case Ro 2025/04/0007-7, decided 24 June 2026 by the Verwaltungsgerichtshof. The authority is monocratic and independent, with no supervisory ministry above it. Two Austrian features pull in opposite directions. First, § 11 DSG instructs the authority to apply the European penalty catalogue proportionately and, especially for first-time breaches, to use a warning rather than a fine — this is why Austrian fine counts look low next to Ireland or Spain. Second, § 30(5) DSG says no fine at all may be imposed on authorities, public bodies or public-law corporations, so a large slice of Austrian processing is fine-free by statute. Austria also punches above its weight on doctrine rather than volume: the Austrian authority issued the first European decision holding a website's use of Google Analytics unlawful. Rating: active rather than aggressive — the output is decisive and now court-tested, but the volume is modest and the law itself tells the regulator to warn first.

The ceiling is the storage-limitation principle in Article 5(1)(e) of the General Data Protection Regulation, backed by the erasure right in Article 17, which expressly steps aside where processing is needed to meet a legal obligation. The Austrian floor sits in the Federal Fiscal Code (Bundesabgabenordnung) and the Commercial Code (Unternehmensgesetzbuch); the commonly applied figure is seven years from the end of the relevant financial year, with longer periods for property-related records. We could not open the official consolidated text of either statute during this run because the Austrian legal information system blocked automated access, so the seven-year figure is recorded as unconfirmed below and the confidence here is medium. Two Austrian points we did verify: the Data Protection Act itself imposes no general minimum log-retention duty on ordinary businesses, and there is no Austrian equivalent of a six-month blanket log-keeping direction. Practical rule: never build deletion automation that ignores the accounting floor, and never treat the accounting floor as a licence to keep the whole customer record.

The 72-hour clock and the duty to tell affected people come from Articles 33 and 34 of the General Data Protection Regulation; the Austrian regulator restates the deadline on its own site as 'unverzüglich und möglichst binnen 72 Stunden'. The second clock runs to the Austrian network and information security authority, which is the Ministry of the Interior, with reports filed through the government computer emergency teams at nis.govcert.gv.at, nis.cert.at and nis.energy-cert.at. The official Austrian network security portal does not publish the reporting deadline in hours, so we have not stated one — that is a gap, not a finding. The third clock is the Digital Operational Resilience Act for financial entities, live since 17 January 2025, which has its own initial, intermediate and final reporting stages. Where the same incident triggers several clocks, the shortest one governs your first hour, and the mismatch between them is the single most common operational failure.

(1) AGE FOURTEEN. § 4(4) DSG makes a child's consent to an online service valid once the child has completed their fourteenth year — Austria took the lowest option the European rule allows, so an age gate built for Germany's sixteen will be wrong here and one built for thirteen will also be wrong. (2) CRIMINAL LIABILITY. § 63 DSG punishes using, disclosing or publishing personal data entrusted to you through your job, with intent to enrich yourself or to harm someone's right to secrecy, with up to one year's imprisonment or a fine of up to 720 daily income units. This attaches to individuals, not the company. (3) THE SECOND FINE. § 62 DSG creates an administrative offence carrying up to 50,000 euros for, among other things, deliberately breaching the data-secrecy duty or operating image capture contrary to the rules — and attempt is punishable. It bites only where European fines do not, so it is easy to miss. (4) DATA SECRECY IS A CONTRACT DUTY. § 6 DSG requires controllers and processors to bind their staff contractually to transmit personal data only on express instruction and to keep the data secret even after the job ends. A standard European processor agreement does not do this by itself. (5) PUBLIC BODIES ARE FINE-FREE. § 30(5) DSG bars fines against authorities, public bodies acting on statutory mandate and public-law corporations — your Austrian government customer carries no fine risk, so it will not share your urgency, and the risk lands on you. (6) A SEPARATE REGULATOR FOR PARLIAMENT. Complaints about data processing by the Austrian Parliament go to a Parliamentary Data Protection Committee, not to the Data Protection Authority. (7) SURVEILLANCE CAMERAS. Austria keeps its own image-processing rules in §§ 12 and 13 DSG on top of European law, including specific security and signage duties.

PENDING COURT CASE. Sixty-seven members of the Austrian Parliament challenged § 11(1)(9) of the State Protection and Intelligence Service Act (Staatsschutz- und Nachrichtendienst-Gesetz), introduced in July 2025, which allows monitoring of encrypted messages by installing software on a target's computer system. The case is G 13-14/2026 and the oral hearing was held on 22 June 2026. Austria's Constitutional Court struck down the predecessor surveillance software provisions in 2019, so a second annulment is a live possibility — a rule that reads as binding today could become unenforceable overnight. NIS2 STILL MISSING. As at 18 August 2026 the Austrian government's own network security portal still describes the national law as implementing the 2016 directive and says the existing framework 'requires adaptation' for the newer one. The transposition deadline was 17 October 2024. When it lands, scope widens sharply into manufacturing, food, waste, postal services and digital providers, and registration windows in other member states have been short. DORMANT SWITCHES. Three matter. The Data Protection Authority can order a company to suspend flows to a third country, which usually hurts more than a fine. The government could reintroduce telecom data retention by ordinary legislation at any time. And the Freedom of Information Act, in force since 1 September 2025, is only now being tested — Austria's Constitutional Court gave its first rulings on 14 July 2026, including on a state-owned bank, so expect a widening pool of documents that companies dealing with Austrian public bodies can no longer assume stay private.