AustriaDatenschutzgesetz (DSG), Data Protection Act
Datenschutzgesetz (DSG), BGBl. I Nr. 165/1999, as amended by BGBl. I Nr. 50/2025
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Establish and document a lawful basis under General Data Protection Regulation (GDPR) Article 6 before processing any personal data of a person in Austria.NIST Privacy FrameworkCT.PO-P1
- Allocate and document controller and processor responsibilities in a written agreement wherever a third party processes personal data on your behalf, following GDPR Articles 24 to 28.NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text. Also read by: Datenschutzbehörde (Austrian Data Protection Authority) (guidance, recorded ); Verfassungsgerichtshof (Constitutional Court), judgment of , G 287/2022-16 and G 288/2022-14, published as Federal Law Gazette I No. 2/2023 (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.dsb.gv.at/rechte-pflichten/ihre-pflichten-als-verantwortlicher
- Case citation
- Verfassungsgerichtshof (Constitutional Court), judgment of , G 287/2022-16 and G 288/2022-14, published as Federal Law Gazette I No. 2/2023
- Guidance body
- Datenschutzbehörde (Austrian Data Protection Authority)
- Open questions
- Which processing is carried out for scientific, artistic or literary purposes under Section 9(2) of the Datenschutzgesetz, so that most of GDPR Chapters II to VII and IX do not apply to it, when the same processing also serves a commercial product?
What it makes you log
Who may demand the log
Regulator
Log retention
Recorded images are deleted once the purpose no longer needs them. Keeping them beyond 72 hours is allowed only if proportionate and must be logged and justified separately. The figure concerns the recordings themselves; the Act states no period for keeping the log.
- Unit
- Days
- As of
- Basis
- Purpose bound
- Maximum value
- 3
Logging duty
Section 13(2) requires the controller to log every processing operation on an image recording made for private purposes, except real-time monitoring. Section 13(3) requires a controller that keeps a recording longer than 72 hours to show the retention is proportionate and to log and justify it separately. The section does not list what the log must contain. The logging rule in Section 50 belongs to the Act's third main part on competent authorities and is not part of this regime.
- Kind
- Explicit
- As of
- Provision
- Datenschutzgesetz Section 13(2) and (3) (a log of every processing operation on a private image recording, and a separate logged justification for keeping one beyond 72 hours)
- Trigger
- personal_data_processing
What this law does
The General Data Protection Regulation (GDPR) applies directly in Austria, and the Datenschutzgesetz (DSG), BGBl. I Nr. 165/1999 as amended by BGBl. I Nr. 50/2025, supplies domestic institutional and procedural provisions: the structure of the Datenschutzbehorde (DSB) and criminal offenses for data misuse under DSG Section 63. The Constitutional Court repealed paragraph 1 of section 9 DSG, the media privilege, as unconstitutional. The repeal took effect at the end of .
Section 9 DSG was re-regulated from by the amending act published as Federal Law Gazette I No. 62/2024. DSG Section 12 adds its own lawfulness grounds for image recordings made for private purposes, subject to the safeguards of Section 13.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .