What Is Bundesgesetz zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten (Datenschutzgesetz – DSG)?
Austria’s operative national statute is the Datenschutzgesetz (DSG), originally published in BGBl. I Nr. 165/1999. The current RIS consolidated text is labelled “Fassung vom 21.08.2026,” and the amendment history runs through BGBl. I Nr. 50/2025. The DSG operates alongside the GDPR, while its post-1 July 2024 §9 media and journalism provisions must be used instead of older summaries. The general framework includes GDPR Chapter III rights, Austria’s constitutional right to secrecy, and a complaint route before the Datenschutzbehörde. No general rule that publicly available data lose all protection was located. No Austria-specific data-broker or public-record-specific deletion route was located either; that finding remains “not located,” with ordinary GDPR erasure, objection, and complaint mechanisms available where applicable.
At a glance
- Full name
- Bundesgesetz zum Schutz natürlicher Personen bei der Verarbeitung personenbezogener Daten (Datenschutzgesetz – DSG)
- Short code
- DSG
- Jurisdiction
- Austria
- Enacted
- 1999
- Last major update
- Amended by BGBl. I Nr. 50/2025; the media and journalism regime in §9 was substantively rewritten effective 1 July 2024 after the former §9(1) was invalidated
- Regulator
- Austrian Data Protection Authority (Datenschutzbehörde)
- Private right of action
- Limited
Scope, who DSG covers
Protected data
Data subject rights
Right to transparent information and processing notices
Right of access, including the Article 15(3) copy right
Right to rectification
Right to erasure subject to Article 17 exceptions
Right to restriction of processing
Right to data portability
Right to object, including an absolute objection to direct marketing
Safeguards concerning automated decision-making
Special, restricted access and correction mechanisms for qualifying media and journalism processing
Right to complain to the Datenschutzbehörde
Notable features
Austria combines GDPR rights with a constitutional secrecy right and a detailed national overlay. The current §9 media and journalism regime was rewritten in 2024 after a constitutional invalidation and contains significant limits for qualifying processing. The DSG also has a separate Third Main Part for law-enforcement processing and does not create a universal public-availability exemption from privacy rights.
Enforcement & penalties
Regulator: Austrian Data Protection Authority (Datenschutzbehörde)
Penalties: GDPR Article 83 provides fines of up to €10 million or 2% of worldwide annual turnover for the Article 83(4) category, and up to €20 million or 4% of worldwide annual turnover for the Article 83(5)-(6) category, including data-subject-rights violations. DSG §30(5) creates a narrow exemption for authorities, public bodies, and specified public-law entities, not a blanket exemption for all controllers. DSG §62 creates a separate residual Austrian administrative offence with a fine of up to €50,000 where the conduct is not already an Article 83 offence or subject to a stricter penalty.
Private right of action: Complaint and judicial-review routes are identified rather than a general private damages action. A complainant may appeal to the Federal Administrative Court if the Datenschutzbehörde does not process the complaint or provide the required information within the applicable period. A separate general private action specifically for data-broker deletion was not located.
Relevance to data brokers
No Austria-specific data-broker or public-record-specific complaint/deletion route was located. The general route is to contact the website or original publisher, request Article 17 erasure where applicable, and complain to the Datenschutzbehörde if the controller does not comply. Search-engine delisting does not remove the original page. Public availability may affect the DSG §1 secrecy analysis, but no broker-specific consumer deletion or opt-out route was located.
Generate requests in under 60 seconds
Generate removal requests for 1,034 US/global profiles, $9
FAQ
Is Austria’s Datenschutzgesetz still based on the original 1999 text?+
The statute originated in 1999 but the current RIS consolidated text includes many amendments, in 2025. The media and journalism rules in §9 were substantially rewritten effective 1 July 2024.
How long do I have to complain to Austria’s Datenschutzbehörde?+
A complaint must be filed within one year after learning of the alleged violation and no later than three years after the event. The Datenschutzbehörde must provide status or result information within three months; the general six-month administrative rule is a backstop, not a guaranteed final-resolution deadline.
Does Austria have a dedicated data-broker deletion route?+
Not located. The reviewed materials identify the ordinary GDPR access, erasure, restriction, objection, search-engine, and Datenschutzbehörde complaint mechanisms, but no Austria-specific broker or public-record deletion route.
Official sources & citations
Other international privacy regimes
DSG sits in a global ecosystem of data-protection laws. Compare with other jurisdictions that shape cross-border data flows: