Processes personal data, in Austria

Datenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 50/2025 · Read the law's page

• Establish and document a lawful basis under GDPR Article 6 before processing any personal data of a person in Austria.
• Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, following GDPR Articles 24 to 28.

Regulation (EU) 2016/679, Art. 9 · Read the law's page

• Obtain explicit consent, or establish another GDPR Article 9(2) basis, before capturing or storing a faceprint, voiceprint, or other biometric identifier derived from a photo, video, or audio recording, whether or not the source recording itself was publicly available.
• Treat any biometric identifier your system derives through its own technical processing as special category data under Austrian and EU law alike, even where the underlying image or audio was lawfully public.

Regulation (EU) 2016/679, Arts. 12-21; Datenschutzgesetz (DSG) § 4 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Austria within one month of receipt.
• You need not, as a rule, give a person in Austria access to their personal data under GDPR Article 15 where disclosing it would endanger a business or trade secret of yours or of a third party, under DSG Section 4(6).
• If economic or technical reasons mean you can correct or erase a person's automated personal data in Austria only at set times, restrict its processing until then, with the effect of GDPR Article 18(2), under DSG Section 4(2).

Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page

• Notify the Datenschutzbehorde without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach affecting a person in Austria, unless the breach is unlikely to risk their rights and freedoms.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• Notify affected individuals without undue delay where a breach is likely to result in a high risk to their rights and freedoms.

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on a European Commission adequacy decision, Standard Contractual Clauses with a transfer impact assessment, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Austria outside the European Economic Area.

Regulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4 · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Entwurf Bundesgesetz über die Haftung für ein fehlerhaftes Produkt 2026 (Produkthaftungsgesetz 2026 – PHG 2026) · Read the law's page

• If you develop or make software, or have it designed or made, you answer as its manufacturer; free and open-source software developed or supplied outside a business activity is outside the Act (§§ 2(1), 2(10) and 17 point 1).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect caused by software, by an update or upgrade, or by a missing necessary update is not excused because it arose after you put the product into circulation (§§ 2(5) and 8(2)).
• Meet the product safety requirements that apply to your product, safety-relevant cybersecurity requirements included: they count in judging whether it is defective (§ 5(2) point 6), and failing a binding requirement that protects against the injury suffered presumes it defective (§ 7(2) point 2).
• Account for what your product learns or acquires after it is put into circulation: the effect of that ability is weighed in judging whether it is defective (§ 5(2) point 3).
• Keep records you could produce if a court orders disclosure on a claimant's plausible claim; failing to disclose relevant evidence after a court order presumes the product defective (§§ 6(1) and 7(2) point 1).
• If you are a manufacturer established outside the Union, your importer and your authorized representative answer as the manufacturer does, and where there is neither, the fulfilment service provider answers (§ 3(1) point 3).
• If you substantially modify a product outside the manufacturer's control and then make it available on the market or put it into operation, you answer as its manufacturer (§ 3(2)).
• If you are a supplier, or an online platform that lets consumers conclude distance contracts with traders, name an economic operator established in the Union or your own supplier within one month of an injured person's request, or you answer for the defective product (§ 3(3) and (4)).
• Do not rely on a contract term to exclude or limit your duty to compensate in advance (§ 9).
• A claim under the Act is time-barred three years after the injured person knew or should have known of the damage, the defect and the liable operator, and ten years after you put the product into circulation or into operation (25 years for a latent bodily injury) unless proceedings were started earlier (§§ 13 and 14).