Austria

Section 207a(4) defines image-based sexual abuse material and sexual depictions of minors to include, at Z 4, any pictorial representation whose viewing creates the impression, whether through alteration of an image or without using one at all, that it is a representation of the kind described in Z 1 to 3: a realistic depiction of a sexual act involving a person under 14, or of an event that appears to be such an act, or the same acts involving a minor between 14 and 18.

This reaches a wholly AI-generated or synthetically altered image with no underlying real depiction, on the same footing as a real photograph, provided the image is realistic. Producing such an image, or offering, procuring, supplying, showing, or otherwise making it accessible to another, is an offense under Section 207a(1). Knowingly accessing one online is a separate offense under Section 207a(3a). Merely possessing or procuring one is punishable under Section 207a(3).

A controller must notify the Datenschutzbehorde without undue delay, and within 72 hours where feasible, after becoming aware of a personal data breach, and must notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. No Austria-specific derogation from this timeline or threshold was identified in the DSG.

The General Data Protection Regulation (GDPR) applies directly in Austria, and the Datenschutzgesetz (DSG), BGBl. I Nr. 165/1999 as amended by BGBl. I Nr. 24/2018, supplies domestic institutional and procedural provisions: the structure of the Datenschutzbehorde (DSB), criminal offenses for data misuse under DSG Section 63, and a media privilege under Article 9 DSG that the Constitutional Court held unconstitutional and that was re-regulated alongside Austria's new Freedom of Information Act from September 2025.

Lawful bases follow GDPR Article 6 unmodified, and controller and processor duties follow GDPR Articles 24 to 28 with no Austrian derogation identified.

Transferring personal data of a person in Austria outside the European Economic Area requires a European Commission adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation, backed by the highest Article 83(5) fine tier (up to EUR 20 million or 4 percent of global turnover). This is a real, structured condition on outbound transfer, not an absence of restriction. No Austria-specific derogation from this framework was identified.

General Data Protection Regulation (GDPR) Articles 12 to 23 give a person in Austria rights of access, rectification, erasure, restriction, portability and objection, plus Article 22 rights against a decision based solely on automated processing that produces legal or similarly significant effects. DSG Sections 42 to 45 give Article 22 domestic procedural effect.

The Datenschutzbehorde's September 2025 finding that KSV1870's credit scoring was prohibited automated decision-making under Article 22 was overturned by the Verwaltungsgerichtshof (Supreme Administrative Court) on 11 June 2026, which held the scoring parameters were not personal data in that instance. This narrows the DSB's Article 22 theory in the credit-scoring context but leaves the underlying statutory right and DSB enforcement authority unchanged.

The Datenschutzbehorde (DSB) is Austria's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 administrative fines of up to the greater of EUR 20 million or 4 percent of global turnover, plus DSG Section 63 criminal offenses for data secrecy violations.

Article 82 arms an individual with a direct private right of action for material or non-material damage, without a seriousness threshold, per the CJEU's first Article 82 ruling, C-300/21 UI v Osterreichische Post AG (4 May 2023), itself referred by the Austrian Supreme Court. Since 2 December 2024, noyb is a Qualified Entity under Austria's Qualifizierte-Einrichtungen-Gesetz, letting it bring collective Article 80(2) redress actions.

Article 9(1) prohibits processing special categories of personal data, including biometric data processed to uniquely identify a person, unless a listed Article 9(2) exception applies, most often explicit consent. Austria adds no separate statutory biometric regime alongside General Data Protection Regulation (GDPR) Article 9. The Datenschutzbehorde found in 2021 that Clearview AI's scraped facial recognition database was unlawful under Austrian data protection law for processing biometric data without a lawful basis.

No Austria-specific guidance on voiceprint biometrics is identified; the GDPR baseline, that a voiceprint captured through specific technical processing for identification is special category data on the same footing as a faceprint, governs by default.

Section 118a punishes anyone who gains access to a computer system, or part of one, by overcoming a specific security measure, with intent either to obtain personal data whose secrecy is protected or to cause harm through the accessed data or system; prosecution requires the victim's authorization. Section 126a punishes altering, deleting, rendering unusable, or suppressing data over which the offender lacks sole authority, where this damages another.

Section 126b punishes seriously disrupting a computer system's functioning by entering or transmitting data. Section 126c punishes creating, acquiring, distributing, or possessing a program, device, password, or access code built or adapted for committing these offenses, with intent that it be so used. None of the four turns on whether the targeted content was publicly viewable; each turns on overcoming a technical or legal barrier to access, or on the tool's built purpose.

Section 42h(1) to (5) lets a research organization, a cultural-heritage institution, or an individual researcher acting for one, reproduce a lawfully accessed work to mine text and data for scientific or artistic research, and store the reproduction as long as the research purpose justifies it; this exception cannot be contracted away and applies even where a for-profit undertaking participates in a public-private partnership with the research or heritage institution.

Section 42h(6) creates a separate, general exception letting any person reproduce a lawfully accessed work for their own text-and-data-mining, for any purpose, unless the rightsholder has expressly prohibited the reproduction through an adequately signaled reservation, in particular a machine-readable one for works made available online.

The dossier for this visit listed a distinct 'Section 42i' covering the general opt-out exception; no such section exists in the consolidated UrhG text read for this visit, and the general exception is Section 42h(6) itself.

A database whose compilation, verification, or presentation required a substantial investment is protected as such under Section 76c, independent of any copyright in its contents.

Section 76d gives the database's producer the exclusive right to reproduce, distribute, broadcast, publicly communicate, and make available the whole database or a substantial part of it, and treats the repeated and systematic extraction or re-utilization of insubstantial parts the same way where this conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests.

Section 76e voids any contractual term by which a lawful user agrees not to extract or re-utilize insubstantial parts, to the extent that doing so neither conflicts with normal exploitation nor unreasonably prejudices the producer. The right lasts fifteen years from completion, or from publication if the database is published within that period.

Section 1 of the Bundesgesetz gegen den unlauteren Wettbewerb (UWG) lets an injured party seek an injunction, and damages where the defendant is at fault, against anyone who, in the course of trade, applies an unfair commercial practice or other unfair conduct capable of more than trivially affecting competition to the disadvantage of undertakings, or a commercial practice contrary to professional diligence that is likely to materially distort the economic behavior of the average consumer it reaches.

Austria has no scraping-specific unfair-competition or misappropriation doctrine; this general clause is the only unfair-competition authority identified, and no reported Austrian judgment applying it to unauthorized data extraction or web scraping was located in the sources checked.

Section 17 requires an operator of essential services, designated under Section 16 in the energy, transport, banking, financial-market-infrastructure, health, drinking-water or digital-infrastructure sector, to take technical and organisational security measures for the network and information systems it uses to provide the essential service, appropriate and proportionate to the state of the art and to the risk that can be identified with reasonable effort, and to prove compliance to the Bundesminister für Inneres at least every three years.

Section 21 places the equivalent duty on a digital service provider, defined by Section 3(12) and (13) as an online marketplace, online search engine or cloud-computing service with a main establishment or a designated representative in Austria and excluding a micro or small enterprise, covering at minimum the security of its systems and facilities, incident handling, business-continuity management, monitoring and testing, and compliance with international standards.

This is Austria's transposition of the original NIS Directive (Directive (EU) 2016/1148); the successor Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) repeals Sections 2 to 31 of this Act, this provision included, on 1 October 2026, documented on this jurisdiction's companion rows.

Section 32 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity), as Section 24 defines them against the Annex 1 and Annex 2 sector lists and the medium- or large-enterprise thresholds Section 25 sets, to implement appropriate and proportionate technical, operational and organisational risk-management measures to reduce the risks to the security of the network and information systems it uses for its operations or to provide its services, and to prevent or minimise the impact of cybersecurity incidents on the users of its services and on other services.

The measures must follow an all-hazards approach and cover at least ten categories: risk analysis and information-system security concepts; cybersecurity-incident handling; business continuity, including backup management, disaster recovery and crisis management; supply-chain security, including the security practices of direct suppliers and service providers; security in the acquisition, development and maintenance of network and information systems, including vulnerability management and disclosure; policies and procedures to assess the effectiveness of risk-management measures; basic cyber-hygiene practices and cybersecurity training; policies on the use of cryptography and, where appropriate, encryption; personnel security, access-control concepts and asset management; and multi-factor or continuous authentication, secure voice, video and text communication and, where appropriate, secure emergency communication systems, transposing NIS2 Article 21.

Section 28, the territoriality provision, names an online marketplace, an online search engine and a platform for social-networking services expressly among the digital providers it reaches, alongside cloud-computing, data-centre, content-delivery-network, managed-service and managed-security-service providers.

Section 31 places implementation and oversight of these measures on the entity's management body (Leitungsorgan), which must attend cybersecurity training designed for it and ensure staff receive regular training.

Section 19 requires an operator of essential services to notify a security incident affecting an essential service it provides, without delay (unverzüglich), to its competent Computer Notfallteam (CERT), which forwards the notification to the Bundesminister für Inneres; the notification must contain every relevant detail known at the time, with later developments reported in follow-up and final notifications.

Section 21(2) places the equivalent duty on a digital service provider, limited to a case where the provider has access to the information needed to assess the incident's impact. Neither provision fixes a numeric notification clock: both require the report without undue delay rather than on NIS2's own 24-hour and 72-hour deadlines.

This is Austria's transposition of the original NIS Directive (Directive (EU) 2016/1148); the successor Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026) repeals Sections 2 to 31 of this Act, this provision included, on 1 October 2026, and replaces this notification duty with NIS2's own fixed clock, documented on this jurisdiction's companion rows.

Section 34 requires a wesentliche Einrichtung (essential entity) or wichtige Einrichtung (important entity) to notify its competent sector-specific CSIRT, or, absent one, the national CSIRT, of every significant cybersecurity incident (defined by Section 35) without delay: an early warning within 24 hours of becoming aware of the incident, stating whether it is suspected to result from unlawful and culpable acts or to have cross-border effects, followed by a fuller notification within 72 hours updating that assessment with an initial evaluation of the incident's severity and impact and any indicators of compromise.

It also requires an interim report on the CSIRT's or the Cybersicherheitsbehörde's request, and a final report no later than one month after the 72-hour notification, or, if the incident is still ongoing at that point, a progress report followed by a final report once it is resolved, transposing NIS2 Article 23.

Section 35 treats a cybersecurity incident as significant where it has caused or can cause severe operational disruption or severe financial loss to the entity, or has affected or can affect another natural or legal person through considerable material or non-material damage, judged against criteria including the dependency of other Annex 1 or Annex 2 sectors on the affected service, the entity's market share, and the incident's possible geographic and cross-border reach.

A service provider that produces a press publication, in analogue or digital form, on its own initiative and under its own editorial responsibility and oversight, holds the exclusive right to reproduce the whole publication or parts of it, and to make it available to the public online, within an information-society service.

A press publication is a collection of predominantly journalistic literary works, published under a common title as a periodically appearing or regularly updated title such as a newspaper, magazine, or journal, and intended to inform the public about news or other topics; scientific and academic periodicals are expressly excluded. The right lasts two years from the press publication's own publication, and cannot be exercised to the detriment of an underlying author's or performer's own rights.

Section 42h(6) UrhG lets any person, for any purpose, reproduce a work they have lawfully accessed in order to mine text and data in digital form automatically, including for indexing and aggregation. This general exception does not apply where the rightsholder has expressly prohibited the reproduction and signaled that prohibition adequately, in particular through machine-readable means for a work made available online.

This is Austria's transposition of the Digital Single Market (DSM) Directive's general, opt-out-based text-and-data-mining exception, distinct from the narrower, non-waivable scientific-research exception in Section 42h(1) to (5). No dedicated 'Section 42i' exists in the consolidated UrhG; an earlier dossier entry citing that section number for this exception was checked against the primary text and corrected here.