Data Protection Act (DSG)

· About Data Protection Act (DSG)

Key Takeaways

  • Austria’s Data Protection Act (Datenschutzgesetz, DSG) applies alongside the GDPR and adds Austrian-specific rules on secrecy, journalistic processing, and national enforcement procedure[1][11].
  • The DSG entered into force on 25 May 2018, replacing the former Data Protection Act 2000 after Austria’s GDPR alignment reform[1][13].
  • The Austrian Data Protection Authority enforces both the GDPR and the DSG, and the Austrian legal information system remains the authoritative source for the consolidated text[1][11].
  • The current consolidated DSG text has been amended through BGBl. I Nr. 50/2025, with official Austrian sources indicating the law remained in force and current in late 2026[5][3].
  • Austrian public guidance states the DSG supplements the GDPR; for many operational rules, compliance teams must read the DSG together with the GDPR rather than treat it as a separate regime[1][10][11].
  • Penalties for DSG-related breaches are primarily administered through the GDPR enforcement framework, while Austrian-specific national provisions can also trigger administrative and sectoral consequences[15][11].

What It Is

The Austrian Datenschutzgesetz (DSG) is the federal law that supplements the GDPR in Austria and sets out additional national rules on data protection, including the constitutional right to secrecy and special provisions for media, law enforcement interfaces, and supervisory procedure[1][2][11]. The law is enforced by the Austrian Data Protection Authority; official Austrian guidance points compliance officers to the Republic of Austria’s legal information system for the current consolidated text[1][11].

The DSG’s modern form dates from Austria’s GDPR alignment reform. Official sources show the current DSG entered into force on 25 May 2018[1][13]. The official consolidated text and Austrian government references show later amendments, including a 2024 modification and a 2025 amendment, with the consolidated text still current in 2026[5][3].

Key phase-in milestones include:

  • 25 May 2018: the revised DSG entered into force together with the GDPR framework in Austria[1][13].
  • 15 July 2024: the consolidated official text reflects the 2024 amendment history in RIS[5].
  • 1 September 2025: reputable secondary analysis reports targeted changes to sections on confidentiality and supervisory material[4].
  • 2026: official Austrian pages still describe the DSG as the current national supplement to the GDPR[1][11].

Who Must Comply

The DSG applies to controllers and processors operating in Austria to the extent they process personal data under the GDPR, because the DSG is the national supplement to that directly applicable EU law[1][11]. In practice, this means Austrian establishments, public bodies, and private-sector organizations that process personal data in Austria must treat the DSG as part of their compliance baseline[9][13].

The law also has extraterritorial reach only through the GDPR, not as a separate Austrian expansion of jurisdiction. If an organization is subject to the GDPR because it targets individuals in the EU or monitors their behavior, Austrian DSG provisions apply whenever Austrian national rules are implicated by the processing context[1][11].

Important national carve-outs exist. Austrian official material notes that the DSG contains special rules on the right to secrecy and sector-specific provisions, including journalism and media processing, which can narrow or modify ordinary GDPR operation in those contexts[2][11]. Public-law bodies and institutions subject to special confidentiality or oversight regimes may also face tailored rules under the DSG and related Austrian laws[1][10].

Core Requirements

  1. Respect the Austrian secrecy right. Austrian law treats the right to secrecy as a special constitutional and statutory privacy protection, so controllers must assess whether a planned processing activity intrudes on protected secrecy interests beyond ordinary GDPR analysis[2].
  1. Apply the DSG together with the GDPR. The DSG is not a standalone replacement for the GDPR; organizations must map each processing activity against both regimes and use the DSG for Austrian-specific deviations, supplements, and procedural rules[1][11].
  1. Use the special rules for media and journalism where relevant. The DSG contains dedicated national provisions for processing in the media and journalism context, and Austrian guidance indicates these provisions must be read in their current post-amendment form[1][6].
  1. Observe Austrian supervisory procedure. The Austrian Data Protection Authority is the competent regulator, and entities responding to complaints, investigations, or orders must follow Austrian procedural rules in addition to GDPR cooperation duties[1][15].
  1. Maintain lawful processing, transparency, and security controls. Where the DSG adds no special derogation, the GDPR’s core duties still govern lawful basis, notice, data subject rights, breach handling, and technical and organizational measures; the DSG supplements rather than displaces those obligations[1][11].
  1. Track national amendments and sector-specific overlays. Austrian official sources show the DSG has been amended repeatedly, including in 2024 and 2025, so compliance documentation and legal assessments must be updated against the current RIS text rather than older summaries[3][5][12].

Deadlines and Penalties

| milestone | date | what applies | |---|---:|---| | GDPR-aligned DSG entered into force | 25 May 2018 | Current Austrian DSG regime replaced the older DSG 2000 structure[1][13] | | Latest official consolidated amendment history reflected in RIS | 15 July 2024 | Official consolidated text shows the law’s amended status as of this date[5] | | Reported 2025 amendment effective date | 1 September 2025 | Secondary analysis reports targeted amendments to confidentiality and supervisory provisions[4] |

Maximum fines and other sanctions depend on the underlying breach. Because the DSG supplements the GDPR, many material violations are punished under the GDPR’s administrative fine system, which can reach €20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious categories[1][15]. Austrian national law can also support orders, corrective measures, and other administrative consequences through the Austrian Data Protection Authority[15][11].

How to Comply

  1. Create a DSG-GDPR legal matrix. Map each processing activity to GDPR obligations and then add Austrian-specific checks for secrecy, media/journalism, and any sectoral rules under the current DSG text[1][11].
  1. Update your records to the current consolidated law. Use the official RIS version and current Austrian authority guidance, not older commentary, because the DSG has changed repeatedly and the latest amendment history matters[3][5].
  1. Run a rights-and-secrecy impact review. For high-risk processing, assess whether Austrian secrecy protections create additional constraints beyond the GDPR and document the rationale for lawful processing and necessity[2][11].
  1. Align controls with ISO 27001. Use ISO 27001 for access control, logging, incident response, supplier assurance, and encryption to support the DSG’s security expectations through the GDPR’s security baseline.
  1. Use NIST CSF 2.0 for operational governance. NIST CSF 2.0 is a practical framework for identifying, protecting, detecting, responding, and recovering, which maps well to Austrian investigations, incident handling, and board reporting.
  1. Adopt ISO 42001 for AI-enabled processing. If personal data is processed in AI systems, ISO 42001 helps structure governance, risk treatment, and lifecycle controls, especially where automated processing intersects with transparency and security duties.
  1. Document regulator-ready procedures. Maintain complaint-handling, data-subject response, breach notification, and supervisory-cooperation playbooks so the organization can respond quickly to the Austrian Data Protection Authority[15][11].

Related Regulations

  • GDPR: This is the primary directly applicable EU regime, and the DSG functions as Austria’s national supplement rather than a replacement[1][11].
  • Information Freedom Act (Informationsfreiheitsgesetz): Austrian 2025 commentary indicates confidentiality rules in DSG supervisory work were tied to the secrecy grounds in this law, so access-to-information rules can affect how supervisory materials are handled[4].
  • Telecommunications Act / ePrivacy-style rules: Austrian guidance separates cookie and communications-related enforcement from general DSG enforcement, so cookie and telecom issues may sit under different legal bases[4].
  • Freedom of Information and administrative procedure laws: These can shape what public bodies disclose and how supervisory processes are conducted, especially where secrecy and transparency conflict[3][11].
  • Sector-specific media law: The DSG’s special journalism and media rules may override or refine ordinary GDPR logic for editorial processing[1][6].

FAQ

Does the Austrian DSG apply to companies outside Austria?

Yes, if the company is subject to the GDPR and its processing touches Austrian national rules or involves Austrian data subjects or operations within Austria[1][11]. The DSG does not create a standalone global jurisdiction, but it applies as the Austrian supplement to GDPR-covered processing.

Is the DSG still in force in 2026?

Yes. Official Austrian sources and the consolidated RIS text show the DSG is current, with amendments reflected through 2025 and official guidance still describing it as the applicable Austrian data protection law in 2026[1][3][5]. Organizations should use the latest consolidated version rather than older summaries[3][5].

Does the DSG replace the GDPR?

No. Austrian authorities state that the DSG supplements the GDPR, meaning the two regimes operate together[1][11]. In practice, the GDPR sets the core EU standard and the DSG adds Austrian-specific provisions and derogations.

Who enforces the DSG in Austria?

The Austrian Data Protection Authority enforces the DSG and the GDPR in Austria[15][11]. Organizations facing complaints, inspections, or orders should treat that authority as the primary regulator.

Are there special rules for journalists and media?

Yes. The DSG contains special Austrian provisions for processing in the media and journalism context, and Austrian guidance points to those rules as part of the current national framework[1][6]. Those provisions should be reviewed carefully before relying on ordinary GDPR assumptions.

What is the biggest compliance risk under the DSG?

The biggest risk is assuming the DSG is only a copy of the GDPR. Austrian secrecy rules, special sectoral derogations, and recent amendments can change how a processing activity must be assessed and defended[2][4][11].

Sources

Put it into practice

More compliance guides