GDPR Article 82 and Datenschutzbehörde Enforcement in Austria

Criminal exposureYes

Private right of actionYes

Criminal exposure note

DSG Section 63 (Datenverarbeitung in Gewinn- oder Schadigungsabsicht) is a court-prosecuted criminal offense, distinct from the DSG Section 62 administrative fine: using, disclosing, or publishing personal data entrusted to or accessed by the offender solely through professional occupation, or unlawfully obtained, with intent to unlawfully enrich oneself or a third party or to harm the data subject's protected confidentiality interest. Maximum: imprisonment up to one year, or a fine up to 720 daily rates, imposed by a court, unless the act is already subject to a more severe penalty under another provision.

Penalty structure

Article 83(5) GDPR, directly applicable in Austria, sets the higher administrative-fine tier: up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for infringements of the provisions listed in Article 83(5)(a) to (e). The Datenschutzbehorde (DSB) is Austria's competent authority for imposing this fine, per DSG Section 22(5) read with GDPR Article 58(2)(i). DSG Section 62 sets a separate, lower national administrative fine, up to EUR 50,000, for conduct not itself reaching Article 83 GDPR ("Sofern die Tat nicht einen Tatbestand nach Art. 83 DSGVO verwirklicht"), so it never displaces the Article 83 ceiling recorded here.

Rule

Higher of

As of

2 September 2026

Currency

EUR

Fixed cap

20,000,000

Turnover percentage cap

4

Enforcement body

Datenschutzbehorde (DSB), Austria's national data protection supervisory authority, competent for GDPR Article 83 administrative fines and, subsidiarily, the DSG Section 62 national administrative fine.

Enforcement record

DSB Tatigkeitsbericht 2025 (Austrian Data Protection Authority annual activity report): in the 2025 reporting period the DSB issued 75 decisions (Bescheide) within administrative-penalty proceedings (Verwaltungsstrafverfahren) brought under GDPR Article 83 and, subsidiarily, DSG Section 62; 58 of those were fines totaling approximately EUR 145,000. actions_per_year (58) counts only those fine decisions, not the further 17 non-fine dispositions within the same 75, and not the 127 proceedings newly initiated or 85 cases discontinued that year. Counts DSB-imposed administrative fines only; the report does not track private Article 82 civil compensation claims, which run through the ordinary courts. trend is the report's own characterization, that both incoming and completed Verwaltungsstrafverfahren volumes are declining year over year (2025 vs. 2024), which the report attributes to a newly introduced case-triage step (1,800 preliminary screenings in 2025) rather than to fewer violations. A single confirmed fine of EUR 1.5 million (unlawful video surveillance, BVwG judgment of 25 July 2025) is described in the report as the highest the DSB has confirmed to date; this is distinct from a reported EUR 16 million fine against Osterreichische Post AG that the CMS GDPR Enforcement Tracker records as not yet final (under appeal) as of its own report date. median_fine, p90_fine and an all-time total_fines are omitted: the DSB report does not publish a computed median or percentile across its case dataset, and does not state a single cumulative all-time total.

As of

2 September 2026

Trend

Falling

Currency

EUR

Source link

https://dsb.gv.at/sites/site0344/media/downloads/tb2025bf.pdf

Fines per year

145,000

Actions per year

58

Obligation class

Governance