# Private individual: Insufficient legal basis for data processing

- Type: Enforcement
- Source: Austrian Data Protection Authority (dsb)
- Date: 2026-06-09
- Original: https://www.enforcementtracker.com/ETid-3375
- Canonical: https://overview.legal/posts/607185
- Topics: Personal Data, Processing, Supervisory Authorities

## Summary

The Austrian Data Protection Authority (dsb) fined a private individual €1,200 for processing personal data without a sufficient legal basis under GDPR Articles 5(1)(a), 5(1)(b), 6(1), and 9(2). The case involved unlawful data processing by an individual in the private associations sector, with the authority finding the respondent failed to establish a valid legal justification for the processing activities. The decision was issued on June 9, 2026.

## Full text

Austrian Data Protection Authority (dsb) fined Private individual €1,200 on 2026-06-09 for: Insufficient legal basis for data processing.
GDPR Articles: Art. 5 (1) a), b) GDPR, Art. 6 (1) GDPR, Art. 9 (2) GDPR
Sector: Individuals and Private Associations
Country: Austria
Source: https://www.ris.bka.gv.at/Dokumente/Dsk/DSBT_20260609_2026_0_483_002_00/DSBT_20260609_2026_0_483_002_00.pdf

## Cited law provisions (8)

### GDPR — gdpr-art-5-par-1-en

Personal data shall be:

### GDPR — gdpr-art-5-par-1-pnt-a-en

processed lawfully, fairly and in a transparent manner in relation to the data subject (‘lawfulness, fairness and transparency’);

### GDPR — gdpr-art-5-par-1-pnt-b-en

collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes; further processing for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes shall, in accordance with Article 89(1), not be considered to be incompatible with the initial purposes (‘purpose limitation’);

### GDPR — gdpr-art-6-par-1-en

Processing shall be lawful only if and to the extent that at least one of the following applies:

### GDPR — gdpr-art-9-par-2-en

Paragraph 1 shall not apply if one of the following applies:

### GDPR — gdpr-art-5-en

Principles relating to processing of personal data

### GDPR — gdpr-art-6-en

Lawfulness of processing

### GDPR — gdpr-art-9-en

Processing of special categories of personal data

---
Generated by overview.legal · https://overview.legal/posts/607185 · 2026-11-14