Data Protection Act (DSG)

Implements the GDPR with additional provisions specific to Austria.

Analysis

The Austrian Data Protection Act (DSG) implements the GDPR with additional provisions specific to Austria. Key requirements include:

Appointment of a Data Protection Officer (DPO) for public authorities and organizations whose core activities involve large-scale processing of sensitive data or systematic monitoring of data subjects. The DPO must have expert knowledge of data protection law and practices.

Conducting Data Protection Impact Assessments (DPIAs) prior to processing when the processing is likely to result in high risk to individuals' rights and freedoms. The Austrian Data Protection Authority (DSB) has published a list of processing activities that require a DPIA.

Implementing appropriate technical and organizational measures to ensure data security, including encryption, pseudonymization, and regular testing of security measures. This requirement is emphasized in the DSG and GDPR.

Obtaining explicit consent for processing special categories of personal data, unless another legal basis applies. The DSG provides additional conditions for processing such data.

Maintaining records of processing activities and cooperating with the supervisory authority. This is a key requirement under both the DSG and GDPR.

Organizations face several challenges in complying with the DSG:

Complexity of data flows: Many organizations struggle to understand and map their data flows, especially with distributed systems and third-party data streams. This makes it difficult to apply consistent security policies.

Balancing data utility and protection: Organizations must find ways to protect personal data while still allowing for its use in business intelligence and analytics. This is particularly challenging in Big Data and BI environments.

Implementing granular access controls: Existing IAM tools often don't support the level of granular access control required for Big Data and BI operations, as highlighted in industry research.

Ensuring compliance across distributed systems: Organizations with fragmented data environments find it challenging to apply homogenous security policies across all nodes.

To effectively implement DSG requirements:

Conduct a comprehensive data audit: Map all data flows and processing activities. Tools like data flow mapping software can assist in this process.

Implement a robust Data Security Governance (DSG) framework: This should include clear policies, procedures, and technical controls. Protegrity's DSG implementation guide provides a useful framework.

Use data discovery and classification tools: Implement tools to automatically discover and classify sensitive data across your systems. CaseGuard offers solutions for data classification and protection.

Implement privacy by design: Integrate data protection considerations into all new projects and processes from the outset. The European Data Protection Board provides guidelines on this principle.

Provide regular training: Ensure all staff are aware of their data protection responsibilities. The Austrian Data Protection Authority offers guidance on training requirements.

As of February 2025, there have been no major recent updates to the DSG. However, organizations should:

Monitor the Austrian Data Protection Authority website for any new guidance or amendments.

Stay informed about broader EU data protection developments, as these may impact Austrian law. The European Data Protection Board is a key source for such updates.

The DSG interacts with several other regulations:

EU General Data Protection Regulation (GDPR): The DSG implements and supplements the GDPR in Austria. Organizations must comply with both. The full text of the GDPR is available online.

ePrivacy Directive: This EU directive, soon to be replaced by the ePrivacy Regulation, governs electronic communications and overlaps with the DSG in areas like cookie consent. The current directive can be found here.

Network and Information Security (NIS) Directive: This EU directive on cybersecurity has been implemented in Austria and interacts with the DSG on matters of data security. The NIS Directive text is available online.

The DSG has significant impacts across industries:

Healthcare: The healthcare sector faces particular challenges due to the sensitive nature of health data. The European Commission provides guidance on health data protection.

Financial Services: Banks and financial institutions must balance data protection with anti-money laundering requirements. The European Banking Authority offers guidelines on this balance.

Technology and Big Data: Companies dealing with large datasets face challenges in data minimization and purpose limitation. Industry analyses highlight these specific challenges.

2026-01-02 — New Swiss Data Protection Act (DSG) took effect, providing practical insights for organizations on compliance while maintaining website traffic tracking[7] (source)
2026-01-01 — Swiss DSG aligns with global shifts as new laws like Kentucky and Rhode Island privacy acts take effect January 1, 2026, emphasizing operational maturity in data protection[2] (source)
2025-12-11 — US executive order challenges state AI laws, indirectly pressuring Swiss DSG compliance for AI data processing amid federal preemption efforts[5] (source)
2025-10-18 — EDPB sets GDPR transparency enforcement focus for 2026 under Articles 12-14, impacting Swiss DSG-aligned practices on informing data subjects[4] (source)

Austria NIS2 Act — Austria, Upcoming
UK Data Protection Act 2018 — United Kingdom, Active
Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
COPPA (Children's Online Privacy Protection Act) — United States, Active
Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01