AustriaGDPR Article 82 and Datenschutzbehörde Enforcement in Austria
Regulation (EU) 2016/679, Arts. 82-83; Datenschutzgesetz (DSG) Art. 4
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Osterreichische Post AG, judgment of the Court of Justice of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
DSG Section 63 (Datenverarbeitung in Gewinn- oder Schadigungsabsicht) is a court-prosecuted criminal offense, distinct from the DSG Section 62 administrative fine: using, disclosing, or publishing personal data entrusted to or accessed by the offender solely through professional occupation, or unlawfully obtained, with intent to unlawfully enrich oneself or a third party or to harm the data subject's protected confidentiality interest. Maximum: imprisonment up to one year, or a fine up to 720 daily rates, imposed by a court, unless the act is already subject to a more severe penalty under another provision.
Penalty structure
Article 83(5) GDPR, directly applicable in Austria, sets the higher administrative-fine tier: up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the provisions listed in Article 83(5)(a) to (e). The Datenschutzbehorde (DSB) is Austria's competent authority for imposing this fine, per DSG Section 22(5) read with GDPR Article 58(2)(i). DSG Section 62 sets a separate, lower national administrative fine, up to EUR 50,000, for conduct not itself reaching Article 83 GDPR ("Sofern die Tat nicht einen Tatbestand nach Art. 83 DSGVO verwirklicht"), so it never displaces the Article 83 ceiling recorded here.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Datenschutzbehorde (DSB), Austria's national data protection supervisory authority, competent for GDPR Article 83 administrative fines and, subsidiarily, the DSG Section 62 national administrative fine.
Enforcement record
DSB Tatigkeitsbericht 2025 (Austrian Data Protection Authority annual activity report): in the 2025 reporting period the DSB issued 75 decisions (Bescheide) within administrative-penalty proceedings (Verwaltungsstrafverfahren) brought under GDPR Article 83 and, subsidiarily, DSG Section 62; 58 of those were fines totaling approximately EUR 145,000. The count of 58 actions covers only those fine decisions, not the further 17 non-fine dispositions within the same 75, and not the 127 proceedings newly initiated or 85 cases discontinued that year. Counts DSB-imposed administrative fines only; the report does not track private Article 82 civil compensation claims, which run through the ordinary courts. The report itself characterizes both incoming and completed Verwaltungsstrafverfahren volumes as declining year over year (2025 vs. 2024), which it attributes to a newly introduced case-triage step (1,800 preliminary screenings in 2025) rather than to fewer violations. A single confirmed fine of EUR 1.5 million (unlawful video surveillance, BVwG judgment of ) is described in the report as the highest the DSB has confirmed to date; this is distinct from a reported EUR 16 million fine against Osterreichische Post AG that the CMS GDPR Enforcement Tracker records as not yet final (under appeal) as of its own report date. The DSB report does not publish a computed median or percentile across its case dataset, and does not state a single cumulative all-time total.
- As of
- Trend
- Falling
- Currency
- EUR
- Source link
- https://dsb.gv.at/sites/site0344/media/downloads/tb2025bf.pdf
- Fines per year
- 145,000
- Actions per year
- 58
Settledness
The Datenschutzbehorde states that it has no power to award a data subject compensation and that the ordinary courts decide such claims.
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0300
- Case citation
- Case C-300/21 UI v Osterreichische Post AG, judgment of the Court of Justice of (Third Chamber)
- Open questions
- Which Austrian rules on the extent of financial compensation apply to a claim under Article 82 of Regulation (EU) 2016/679, the question the Court of Justice's ruling in Case C-300/21 leaves to the domestic law of each Member State?
What it makes you log
Logging duty
Article 82 gives a right to compensation for damage and Article 83 sets the conditions for administrative fines. Neither requires a log or a record.
- Kind
- None
- As of
What this law does
The Datenschutzbehorde (DSB) is Austria's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 administrative fines of up to the greater of EUR 20 million or 4 percent of global turnover, plus a criminal offense in DSG Section 63 for using, disclosing or publishing entrusted personal data with intent to enrich oneself or to harm the data subject.
Article 82 arms an individual with a direct private right of action for material or non-material damage, without a seriousness threshold, per the CJEU's ruling in C-300/21 UI v Osterreichische Post AG (), itself referred by the Austrian Supreme Court. The register that the Bundeskartellanwalt publishes under Section 12 of the Qualifizierte-Einrichtungen-Gesetz lists noyb as a qualified entity for both cross-border and domestic collective actions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .