Content type · 49 documents

Enforcement

Regulatory actions, fines, warnings, and enforcement decisions

🇪🇺 EU 🇳🇱 NL
Enforcement dashboard — fines by country, authority and article →
Country: Austria (49) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
dsb · €6,300 Advertising Agency: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Advertising Agency €6,300 on 2026-03-24 for: Insufficient legal basis for data processing. Direct Marketing Processing Supervisory Authorities Mar 24, 2026
Austria · €200 DSB (Austria) - 2026-0.016.479 Facts — A medical student (the controller) worked as a ward attendant at a hospital. Her duties were to remain in the immediate vicinity of patients, ensure their safety and… Legitimate Interest Healthcare Personal Data Jan 12, 2026
Austria DSB (Austria) - 2025-0.968.031 Facts — A data subject published a post concerning their ADHD diagnosis on a publicly accessible online forum under a pseudonym. A person (the controller) who was a follower of… Pseudonymization Personal Data Health Data Dec 3, 2025
dsb · €80 Journalist: Er is onvoldoende juridische basis voor de verwerking van gegevens. 80 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). Personal Data Data Controller Processing NL Nov 18, 2025
dsb · €80 Journalist: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 80 on a Journalist. The controller published unnecessary private data about a data subject on social media, including their address. Personal Data Controllers Social Media Nov 18, 2025
dsb · €1,500 Shop Owner: Insufficient legal basis for data processing Austrian Data Protection Authority (dsb) fined Shop Owner €1,500 on 2025-10-27 for: Insufficient legal basis for data processing. IP Address Processing Human Resources Oct 27, 2025
dsb · €600 Owner of a Tesla Car: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 600 on the owner of a Tesla car. The controller's car had seven cameras installed, which filmed while the car was in use and while it… IP Address Controllers Processing Agreement Sep 29, 2025
dsb · €600 Eigenaar van een Tesla-auto: Niet-naleving van algemene principes voor gegevensverwerking. 600 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). Processing Personal Data IP Address NL Sep 29, 2025
dsb · €33,500 Bakery Chain: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 33,500 on a bakery chain. The controller used video surveillance which affected both public areas and areas intended solely for… Video Surveillance IP Address Retention Period Sep 5, 2025
dsb · €33,500 Bakkerijketen: Niet-naleving van algemene principes voor gegevensverwerking. Een boete van 33.500 euro - van de Oostenrijkse Autoriteit voor Gegevensbescherming (DSB). Video Surveillance Processing IP Address NL Sep 5, 2025
dsb · €870 Bedrijf: Onvoldoende nakoming van de verplichtingen met betrekking tot het melden van datalekken. 870 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). Data Breaches Notification Obligation Supervisory Authorities NL Sep 4, 2025
dsb · €870 Company: Insufficient fulfilment of data breach notification obligations The Austrian DPA has imposed a fine of EUR 870 on a company. After being informed of a data breach, the controller took adequate measures to close it but failed to inform the DPA. Notification Obligation Data Breaches Article 19 GDPR - Notification of Rectification, Erasure or Restriction Sep 4, 2025
dsb · €6,200 Mediabedrijf: Onvoldoende samenwerking met de toezichthoudende instantie. Boete van 6.200 euro - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). Supervisory Authorities Telecommunications Processing Agreement NL Aug 6, 2025
dsb · €6,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 6,200 on a media company. The controller failed to comply with an order from the DPA to implement an adequate cookie banner. Supervisory Authorities Cookies Supervision Aug 6, 2025
dsb · €16,000 Car Park Management Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine in the amount of EUR 16,000 on a car park management company. The controller failed to react to communication from the supervisory authority. Supervisory Authorities Supervision Controllers Jun 3, 2025
dsb · €16,000 Parkeerbeheerbedrijf: Onvoldoende samenwerking met de toezichthoudende instantie. 16.000 euro boete - Oostenrijkse Autoriteit voor Gegevensbescherming (dsb). Supervisory Authorities Supervision NL Jun 3, 2025
dsb · €5,000 Company: Lack of appointment of data protection officer The Austrian DPA has imposed a fine on a company. The controller appointed a DPO who had a conflict of interest, meaning the person was not suitable for the role. Notified Body Responsibilities and Operational Obligations Supervisory Authorities Controllers Oct 16, 2024
dsb · €1,500,000 IKEA: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,500,000 on IKEA. The controller used excessive video surveillance, including in public spaces and the checkout area. Additionally, the… Video Surveillance Controllers Processing Agreement Aug 16, 2024
dsb · €1,500,000 Company: €1,500,000 fine The Austrian DPA has imposed a fine of EUR 1,500,000 on a company, that is part of a group. The controller installed video surveillance devices that did not comply with the GDPR,… Video Surveillance Monitoring Processing Agreement Aug 16, 2024
dsb · €100,000 Covid 19 Test Lab: Insufficient technical and organisational measures to ensure information security The Austrian DPA has imposed a fine of EUR 100,000 on a Covid 19 test lab. The controller failed to implement sufficient technical and organisational measures, resulting in a data… Data Breaches Controllers Processing Agreement Jun 6, 2024
dsb · €10,000 Website operator: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine in the amount of EUR 11,000 on a website operator. An individual had filed a complaint with the DPA because the controller had failed to comply… Controllers Personal Data Processing Agreement Jan 4, 2024
dsb · €15,200 Media Company: Insufficient cooperation with supervisory authority The Austrian DPA has imposed a fine of EUR 15,200 on a media company. The company failed to react to requests by the DPA. Supervisory Authorities Supervision Law Enforcement Jan 2, 2024
dsb · €5,900 AUSTRIA DPA: Insufficient fulfilment of data breach notification obligations The Austrian DPA fined a controller EUR 5,900 for failing to report a data breach in a timely manner and for not cooperating with the DPA. Notification Obligation Data Breaches Notified Body Reporting and Notification Obligations Dec 12, 2023
dsb · €10,000 Phyisician: Non-compliance with general data processing principles The Austrian DPA has imposed a fine of EUR 10,000 on a physician. The physician had responded to an online review regarding their practice, disclosing personal health data of a… Health Data Healthcare IP Address Sep 26, 2023
dsb · €1,000 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 1,000 on a private individual. The controller had sent data subjects electoral advertising without a valid legal basis. Direct Marketing Controllers Personal Data Jun 16, 2023
Austria DSB (Austria) - DSB-D124.4462 Facts — On 03 May 2021, the data subject sent a request to the controller for the erasure of their financial asset information. The controller did not respond to their erasure… Right to be Forgotten Controllers Personal Data Jun 12, 2023
dsb · €28,000 Political party: €28,000 fine The Austrian DPA has imposed a fine of EUR 50,700 on a political party. The controller had sent two emails in an open distribution list. This allowed the recipients to view the… Political Opinions Personal Data Education Jan 1, 2023
dsb · €25,000 Operator of a public toilet: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 25,000 on an operator of a public toilet. The controller had installed a video surveillance camera on the restrooms and secretly… Video Surveillance Controllers Processing Aug 23, 2022
dsb · €8,000,000 REWE International AG: €8,000,000 fine The Austrian DPA has imposed a fine of EUR 8 million on REWE International AG. Just in the summer of 2021, the subsidiary 'Unser Ö-Bonus Club GmbH' received a fine of EUR 2… Processing Agreement Supervisory Authorities Human Resources Jan 14, 2022
dsb · €500,000 Address Broker: Insufficient fulfilment of data subjects rights The Austrian DPA has imposed a fine of EUR 500,000 on an address broker. The controller provided a form for data subjects to exercise their rights. The controller regularly did… Controllers Personal Data Processing Agreement Sep 28, 2021
dsb · €9,500,000 Austrian Post: Insufficient fulfilment of data subjects rights The Austrian DPA imposed a fine of EUR 9.5 million on the Austrian Post on September 28, 2021. The main accusation is that, in addition to the contact options used by Austrian… Processing Agreement Personal Data Supervisory Authorities Sep 28, 2021
dsb · €600 Private individual: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 600 on a private individual. A private individual had sent a document obtained in a court case between the data subject and himself to… Personal Data Healthcare Processing Agreement Aug 5, 2021
dsb · €500,000 Unser Ö-Bonus Club GmbH: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 2,000,000 on Rewe affiliate Ö-Bonus Club GmbH. When signing up for the customer loyalty program jö Bonus Club, the controller is said to… Processing Agreement Controllers Consent Aug 2, 2021
dsb · €3,000 AUSTRIA DPA: Insufficient cooperation with supervisory authority The Austrian DPA has fined a company EUR 3,000 for failing to provide information requested by the DPA during an investigation. Supervisory Authorities Supervision Processing Agreement Feb 12, 2021
dsb · €700,000 Customer loyalty program: €700,000 fine According to the newspaper 'Der Standard', the Austrian DPA has imposed a fine of EUR 1.2 million on a customer loyalty program in 2021. Further information has not yet been… Processing Agreement Controllers Supervisory Authorities Jan 1, 2021
dsb · €600 Private individual: Non-compliance with general data processing principles The Austrian DPA imposed a fine of EUR 600 on a private individual. The individual had contacted a public institution to draw their attention to the fact that the statement of a… Integrity and Confidentiality Principle Personal Data Processing Jan 1, 2021
dsb Private individual: Non-compliance with general data processing principles The Austrian DPA has fined a private individual. The individual had installed a video surveillance system which, among other things, also recorded the public space and stored the… Video Surveillance IP Address Monitoring Jan 1, 2021
dsb · €4,000,000 Bank: Insufficient technical and organisational measures to ensure information security Original fine summary: The Austrian DPA has imposed a fine of EUR 4,000,000 on a credit institution. The controller had stored an Excel file containing personal data, such as… Data Breaches Integrity and Confidentiality Principle Encryption Jan 1, 2021
Austria DSB (Austria) - 2020-0.743.659 Facts — The data subject (customer) filed a complaint against a Viennese restaurant claiming a violation of § 1 Austrian Data Protection Act (Datenschutzgesetz - DSG) and Article… Personal Data Healthcare Right of Access Procedures Nov 19, 2020
dsb · €150 Private Individual: Insufficient legal basis for data processing The private individual recorded a female person while she was using one of the WC cabins by placing a cell phone (smartphone with camera function) under the WC cabin partition… Processing Supervisory Authorities Oct 19, 2020
dsb · €600 Private Individual: Insufficient legal basis for data processing Between February and June 2020, a private individual published information about patients on his personal Facebook page. The information included health data in terms of Art. 4… Health Data Healthcare Healthcare Oct 19, 2020
dsb · €100 Bank: Insufficient legal basis for data processing A bank employee made a copy of the identity card of a bank client who wanted to exchange EUR 100 in foreign currency and justified this with money laundering charges. However,… Insurance Processing Supervisory Authorities Aug 5, 2020
dsb · €16,000,000 Austrian Post: Insufficient legal basis for data processing The Austrian DPA has imposed a fine of EUR 16,000,000 on the Austrian Post. The controller had sold information regarding the political affinity to third parties without a… Controllers Processing Agreement Processing Oct 29, 2019
dsb · €25,000 Company in the medical sector: Insufficient fulfilment of information obligations The (none-final) fine was imposed on a company in the medical sector for non-compliance with information obligations and for not appointing a data protection officer. Update: The… Healthcare Corrective Actions and Duty of Information Framework Supervisory Authorities Aug 1, 2019
dsb · €11,000 Private person (soccer coach): Insufficient legal basis for data processing The fine was imposed on a soccer coach who had secretly filmed female players while they were naked in the shower cubicle for years. Processing Supervisory Authorities Jul 1, 2019
dsb · €2,200 Private person: Insufficient legal basis for data processing The fine was imposed against a private person who was using CCTV at his home. The video surveillance covered areas which are intended for the general use of the residents of the… Video Surveillance Controllers Monitoring Dec 20, 2018
dsb · €4,800 Betting place: Insufficient fulfilment of information obligations Video surveillance was not sufficiently marked and a large part of the sidewalk of the facility was recorded. Surveillance of the public space in this way, i.e. on a large scale… Video Surveillance Monitoring Corrective Actions and Duty of Information Framework Dec 9, 2018
dsb · €300 Private car owner: Insufficient legal basis for data processing A Dashcam was unlawfully used. Processing Supervisory Authorities Sep 27, 2018
dsb · €1,800 Kebab restaurant: Insufficient legal basis for data processing CCTV was unlawfully used. Sufficient information about the video surveillance was missing. In addition, the storage period of 14 days was too long and therefore against the… Video Surveillance IP Address Monitoring Jan 1, 2018