Content type · 70 documents in this view · 3,811 in total
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Austria (50) Clear filter
Filter by Topic Supervisory Authorities 3587 Processing 2635 Personal Data 2394 Controllers 2017 Processing Agreement 1114 Security 1013 Supervision 847 Healthcare 621 Law Enforcement 568 Monitoring 547 Public Authority 539 Consent 508
2025-0.626.844 2025-0.626.844 ·Austria · Oct 2, 2026
2026-0.690.562 The DPA issued a reprimand against a journalist for failing to comply with the data minimisation principle pursuant to Article 5(1)(c) GDPR by publishing a court decision on his… 2026-0.690.562 ·Austria · Oct 1, 2026
DSB: Retailer must grant full access and delete data after third-party fraud order A retailer (controller) sent a notebook to the address of a data subject after having received an order to that address. However, the data subject has never placed the order and… DSB-D124.2016/23 ·Austria ·Art. 6, 13, 14 +2 Aug 26, 2026
Austrian DSB: e-marketplace transfer of customer data to China and US requires valid Art. The DPA was acting upon a complaint addressing the subject matter of third country personal data transfers. The controller, established in Ireland, operates an e-marketplace… D130.2269 ·Austria ·Art. 45, 46, 49 Aug 25, 2026
€1,000 Austrian DSB: Employee who shared customer's phone number acted as GDPR controller An employee (controller) of a company shared the telephone number of a costumer (data subject) with a third person. The third person who was a personal acquaintance of the… Austria ·Art. 4, 5, 6 +1 Aug 18, 2026
€6,300 Advertising Agency: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Advertising Agency €6,300 on 2026-03-24 for: Insufficient legal basis for data processing. Austria · ·Art. 5, 6, 13 Mar 24, 2026
The data subject was employed by an Austrian stock corporation (the controller) from August 2018 to June 2025 They worked as a manager in the controller’s finance department, with technical and disciplinary responsibility for up to five employees. The controller operated a 360-degree… 2025-0.960.016 ·Austria · Mar 20, 2026
DSB Austria: disclosure of health data to court-appointed expert in legal dispute lawful The data subject was involved in a legal dispute before a civil court in which the findings of an expert opinion led to the dismissal of the case. The expert opinion concerned the… DSB-D124.0850/25 ·Art. 9 Jan 28, 2026
€25,500 DSB · 2025-1.049.138 The controller was a digital marketing agency whose employees pre-screened potential applicants for its clients. As part of this process, applicants (data subjects) were contacted… Austria ·Art. 5, 6, 12 +1 Jan 19, 2026
DSB · 2026-0.043.390 Following the first COVID-19 outbreak in March 2020, a limited liability company (the controller) decided to offer protective masks to the general public. It set up an online shop… 2026-0.043.390 ·Austria ·Art. 5, 12, 13 Jan 16, 2026
€200 A medical student (the controller) worked as a ward attendant at a hospital Her duties were to remain in the immediate vicinity of patients, ensure their safety and notify the nursing staff immediately when necessary. While assigned to a patient with… 2026-0.016.479 ·Austria · Jan 12, 2026
DSB: Art. 15 GDPR access right does not extend to full documents with third-party data The data protection authority (DPA) has determined that, according to Article 15 of the GDPR, an individual has the right to access personal data relating to them, but this right… 2025-0.395.497 ·Austria ·Art. 15 Jan 12, 2026
€200 Medical Student: Insufficient legal basis for data processing The Austrian Data Protection Authority (dsb) fined a medical student €200 for processing personal data without a sufficient legal basis under GDPR Article 6(1)(f) and Article… Austria · ·Art. 6, 9 Jan 12, 2026
The controller, an Austrian registered association, operates a therapy centre for psychosomatic illnesses The data subject was a patient of the controller. On 28 July 2025, the data subject sent an access request by email under Article 15 GDPR, asking for full information on all… DSB-D124.2437/25 ·Austria · Jan 9, 2026
€6,820 Austrian media company fined €6,820 for failing to comply with order to fix cookie banner An Austrian media company has been fined €6,820 by the Data Protection Authority because it failed to implement a binding instruction to modify the cookie banner on its website.… Austria · ·Art. 58 Jan 7, 2026
DSB · 2025-0.968.031 A data subject published a post concerning their ADHD diagnosis on a publicly accessible online forum under a pseudonym. A person (the controller) who was a follower of the data… 2025-0.968.031 ·Austria ·Art. 9 Dec 3, 2025
DSB · 2025-0.950.759 On 18 September 2023, a data subject created a customer account with a public limited company operating an online shop (the controller). It allowed customers to place orders… 2025-0.950.759 ·Austria ·Art. 5, 6, 16 +2 Nov 24, 2025
DSB: No processor access violation under Art. 15 GDPR when controller deleted data On 07. August 2023, the data subject made a request to the processor to provide the report and the questionnaire completed by the data subject at an information event. The… 2025-0.566.415 ·Austria ·Art. 4, 5, 12 +3 Nov 21, 2025
€80 Journalist: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 80 on a Journalist. The controller published unnecessary private data about a data subject on social media, including their address. AUSTRIA · ·Art. 5, 6 Nov 18, 2025
€80 Journalist: Er is onvoldoende juridische basis voor de verwerking van gegevens. 80 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 5, 6 Nov 18, 2025
€1,500 Shop Owner: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Shop Owner €1,500 on 2025-10-27 for: Insufficient legal basis for data processing. Austria · ·Art. 5, 6 Oct 27, 2025
€600 Eigenaar van een Tesla-auto: Niet-naleving van algemene principes voor gegevensverwerking. 600 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 5, 6, 12 +1 Sep 29, 2025
€600 Owner of a Tesla Car: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 600 on the owner of a Tesla car. The controller's car had seven cameras installed, which filmed while the car was in use and while it… AUSTRIA · ·Art. 5, 6, 12 +1 Sep 29, 2025
€33,500 Bakkerijketen: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 33.500 euro - van de Oostenrijkse Autoriteit voor Gegevensbescherming (DSB). AUSTRIA · ·Art. 5, 6 Sep 5, 2025
€33,500 Bakery Chain: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for… AUSTRIA · ·Art. 5, 6 Sep 5, 2025
€870 Bedrijf: Onvoldoende nakoming van de verplichtingen met betrekking tot het melden van datalekken. 870 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 33 Sep 4, 2025
€870 Company: Insufficient fulfilment of data breach notification obligations The Austrian DPA has imposed a fine of EUR 870 on a company. After being informed of a data breach, the controller took adequate measures to close it but failed to inform the DPA. AUSTRIA · ·Art. 33 Sep 4, 2025
€6,200 Mediabedrijf: Onvoldoende samenwerking met de toezichthoudende instantie. Boete van 6.200 euro - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 58 Aug 6, 2025
€6,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 6,200 on a media company. The controller failed to comply with an order from the DPA to implement an adequate cookie banner. AUSTRIA · ·Art. 58 Aug 6, 2025
€16,000 Car Park Management Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine in the amount of EUR 16,000 on a car park management company. The controller failed to react to communication from the supervisory authority. AUSTRIA · ·Art. 31 Jun 3, 2025
€16,000 Parkeerbeheerbedrijf: Onvoldoende samenwerking met de toezichthoudende instantie. 16.000 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). AUSTRIA · ·Art. 31 Jun 3, 2025
€5,000 Company: Lack of appointment of data protection officer The Austrian DPA has imposed a fine on a company. The controller appointed a DPO who had a conflict of interest, meaning the person was not suitable for the role. AUSTRIA · ·Art. 38 Oct 16, 2024
€1.5M The Austrian DPA has imposed a fine of EUR 1,500,000 on a company, that is part of a group The controller installed video surveillance devices that did not comply with the GDPR, resulting in the company being fined. Company: €1,500,000 fine ·AUSTRIA · Aug 16, 2024
€1.5M IKEA: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,500,000 on IKEA. The controller used excessive video surveillance, including in public spaces and the checkout area. Additionally, the… AUSTRIA · ·Art. 5, 6 Aug 16, 2024
€100,000 Covid 19 Test Lab: Insufficient technical and organisational measures to ensure information security The Austrian DPA has imposed a fine of EUR 100,000 on a Covid 19 test lab. The controller failed to implement sufficient technical and organisational measures, resulting in a data… AUSTRIA · ·Art. 5, 9, 28 +2 Jun 6, 2024
€10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… AUSTRIA · ·Art. 17, 25, 58 Jan 4, 2024
€15,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 15,200 on a media company. The company failed to react to requests by the DPA. AUSTRIA · ·Art. 58 Jan 2, 2024
€5,900 AUSTRIA DPA: Insufficient fulfilment of data breach notification obligations The Austrian DPA fined a controller EUR 5,900 for failing to report a data breach in a timely manner and for not cooperating with the DPA. ·Art. 31, 33 ·Insufficient fulfilment of data breach notification obligations Dec 12, 2023
DSB-D124.5337 In August 2021, an unprotected Excel file containing the names and PCR test results of several thousand individuals was sent from the compromised email account of the first data… 2023-0.273.912 ·Austria ·Art. 5, 6, 12 +3 Oct 6, 2023
€10,000 Phyisician: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 10,000 on a physician. The physician had responded to an online review regarding their practice, disclosing personal health data of a… AUSTRIA · ·Art. 5, 9 Sep 26, 2023
€1,000 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,000 on a private individual. The controller had sent data subjects electoral advertising without a valid legal basis. AUSTRIA · ·Art. 6 Jun 16, 2023
DSB (Austria): DSB lacks competence over court processing under Art. 55(3) GDPR On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure request. On… 2021-0.909.100 ·Art. 55, 77 Jun 12, 2023
€28,000 Political party: €28,000 fine The Austrian DPA has imposed a fine of EUR 50,700 on a political party. The controller had sent two emails in an open distribution list. This allowed the recipients to view the… AUSTRIA · ·Unknown Jan 1, 2023
€25,000 Operator of a public toilet: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly… AUSTRIA · ·Art. 5, 6, 13 Aug 23, 2022
DSB · 2021-0.643.804 The data subject divorced her husband in a proceeding before the district court (the controller), acting in its capacity as the competent land registry court. As part of the… 2021-0.643.804 ·Austria ·Art. 6, 55 Jun 9, 2022
€8M REWE International AG: €8,000,000 fine The Austrian DPA has imposed a fine of EUR 8 million on REWE International AG. Just in the summer of 2021, the subsidiary 'Unser Ö-Bonus Club GmbH' received a fine of EUR 2… AUSTRIA · ·Unknown Jan 14, 2022
DSB Austria: Publishing companies-register data on free ad-funded platform unlawful The data subject was a shareholder and managing director of two companies. The controller operated a free online search platform that allowed users to look up companies registered… 2021-0.698.184 ·Art. 6, 51, 57 +1 Oct 8, 2021
€9.5M Austrian Post: Insufficient fulfilment of data subjects rights The Austrian DPA imposed a fine of EUR 9.5 million on the Austrian Post on September 28, 2021. The main accusation is that, in addition to the contact options used by Austrian… AUSTRIA · ·Art. 12 Sep 28, 2021
€500,000 Address Broker: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine of EUR 500,000 on an address broker. The controller provided a form for data subjects to exercise their rights. The controller regularly did… AUSTRIA · ·Art. 12 Sep 28, 2021
€600 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 600 on a private individual. A private individual had sent a document obtained in a court case between the data subject and himself to… AUSTRIA · ·Art. 9 Aug 5, 2021