Meet Austria's DSG and GDPR duties with one set of controls

The DSG (Datenschutzgesetz) is Austria's federal data protection law. Since 25 May 2018 it supplements the EU GDPR rather than replacing it, filling in the areas the GDPR leaves to member states. It contains Austria's constitutional right to data protection, rules on data secrecy, image processing and research, the set-up of the Datenschutzbehörde, remedies and penalties, and the national transposition of the EU Law Enforcement Directive.

Any controller or processor that processes personal data in Austria must comply with the DSG alongside the GDPR. This includes Austrian businesses, foreign companies with Austrian establishments, and public bodies. Specific sections matter for particular activities, such as § 12 and § 13 for anyone operating CCTV or other image recording, and § 7 for organisations processing data for research, archiving or statistics.

Most infringements are fined under Article 83 of the GDPR, which the Datenschutzbehörde applies directly. On top of that, § 62 DSG creates administrative offences, such as unlawful access to data, breaching data secrecy or operating image processing contrary to the Act, punishable by fines of up to EUR 50,000. § 63 makes processing data with intent to profit or cause harm a criminal offence carrying up to one year in prison.

The DSG works alongside the GDPR, not instead of it. The GDPR sets the main obligations, such as lawful bases, data subject rights, security and breach notification, while the DSG adds Austrian national rules where the GDPR allows them. Examples include an age of digital consent of 14, a statutory duty of data secrecy for staff, detailed rules on image recording and the procedures of the Austrian Data Protection Authority.

Sections 12 and 13 of the DSG set when image recording is permitted and the safeguards required. Recording is allowed only in specified cases, such as with consent or to protect property or people where there is a legitimate reason, and some places and purposes are excluded. Operators must take special data security measures, log access and clearly label the recording. Breaches can lead to fines under § 62.

The DSG does not require ISO 27001 certification, but an ISO 27001 information security management system supports it well. The security of processing obligations under the GDPR, which the DSG builds on, and the specific data security measures for image processing in § 13 are easier to evidence when you already run documented, risk-based security controls such as those in ISO 27001 Annex A.

Start from a sound GDPR programme, then add the Austrian specifics. Confirm data secrecy obligations for staff, review any CCTV against §§ 12 and 13, check consent flows for children under 14, and document research or archiving processing under § 7. Keep records of processing, security evidence and breach procedures ready for the Datenschutzbehörde, which handles complaints and can inspect organisations.

Yes, on request. The Austrian DSG is mapped in OneClickComply's control library and is available on request rather than as a standard framework today. Once enabled, it reuses the controls and evidence you already hold for GDPR and other frameworks, with policy generation, automated evidence collection and continuous monitoring. OneClickComply does not certify compliance, but our in-house auditors can guide you.