Articles & analyses.
Current articles on data protection law for businesses in Austria.
Mag. Bernhard Brandauer, Austrian attorney-at-law
BRANDAUER Rechtsanwälte
Mag. Bernhard Brandauer advises businesses on the legal classification and practical implementation of data protection requirements.
Confidentiality duties of a data protection officer under Section 5 of Austria's DSG
Section 5 of Austria's DSG protects people who contact the data protection officer and limits use of their information to the officer's tasks.
Genetic analysis in hiring and insurance: limits under Austria’s GTG
Section 67 of Austria’s GTG protects job-seekers, employees and insurance applicants. When may an insurer use Type 1 results?
Immediate supervisory stop for data processing: order under Section 22 DSG
Order under Section 22(4) DSG: when the Austrian Data Protection Authority may prohibit data processing immediately or in part, and what organisations must review about compliance and Vorstellung.
Consent-or-pay at online platforms: when is consent still freely given?
Consent-or-pay models at large online platforms: free advertising-free alternatives, fees, purpose granularity and freely given consent under the GDPR.
Personal data in an M&A data room: purpose, recipients and erasure
How to decide which personal data belongs in an M&A data room, who may access it, and how purpose, recipients, third-country access and erasure are documented.
Three months without a procedural update: requesting information from the DPA
After a data protection complaint, three months pass without news. Sections 24(7) and (8) DSG explain the information duty and the route to the BVwG.
Deceased persons in customer files: separating GDPR rules from estate access
Data about deceased persons in customer files and digital accounts: Recital 27 GDPR, living-person data, confidentiality and estate access.
Supplementary data copy in DPA proceedings: identify the open parts of the request
After a data protection complaint, the controller provides documents for the first time. Learn how to identify which parts of the original request remain open.
Media Privilege on a Corporate Blog: The Boundary Between Journalism and Advertising
Media privilege on a corporate blog: Section 9 DSG, journalistic purpose, media role and the boundary to commercial advertising explained.
Legal persons and data protection: confidentiality under Section 1 DSG
In Austria, a GmbH or association may rely on Section 1 DSG. The key questions are legitimate interest, the link to the data and the distinction from the GDPR.
Permissioned Blockchain with Multiple Nodes: Distinguishing Controllers and Processors
Assess roles in a permissioned blockchain: classify the consortium, node operators and technical providers under Articles 4, 26 and 28 GDPR.
Litigation evidence needed: restrict processing under Article 18
Where a data subject still needs personal data as litigation evidence, Article 18(1)(c) GDPR may support a request to restrict processing before erasure.
Access request without an existing identifier: must the controller reallocate data?
Article 11 GDPR and access requests: when existing data can be allocated, when additional information is needed and what businesses should document.
Processor and subprocessor: securing the audit trail and instruction evidence
Review processors and subprocessors: audit trail, instructions, safeguards, sub-contract and evidence under Article 28 GDPR.
Access request containing third-party data: redact instead of blanket refusal
An access request contains information about other people: assess identity, scope, redactions, the data copy and deadlines under Articles 12 and 15 GDPR.
Checking supplier creditworthiness: legal basis, information and erasure period
Supplier credit checks in B2B procurement: personal data, legal basis, database information, data accuracy and an appropriate erasure period.
Patient data for research projects: purpose compatibility and safeguards
Patient data for research projects: legal basis, purpose compatibility, Article 89 GDPR, anonymisation and safeguards for secondary use.
Mandatory customer accounts: when an online shop should offer guest checkout
Mandatory customer accounts in online shops: when Article 6 GDPR supports an account, when guest checkout is sufficient and how to document alternatives.
Privacy certification in an IT contract: what has actually been certified?
How to assess a privacy certification in an IT contract: certified processing, accredited body, approved criteria and limits of the evidence.
Replacing a subprocessor: prior notice and response period in the data processing agreement
Replacing a subprocessor: prior notice, appropriate response period, objection and data protection duties under Article 28 GDPR.
Data protection for cloud backups: erasure, restoration and proof
Organise cloud backups under the GDPR: erasure, overwriting, restoration, access controls and evidence.
Documenting data protection training: attendance, content and retention
Document data protection training under the GDPR: attendance, content, versions, individual details and retention in a clear structure.
Erasure request despite a retention duty: restriction and access block
Erasure requests despite a statutory retention duty: identify the data, restrict active use, document an access block and respond clearly.
Access Logs in Internal Investigations: Purpose Change and Evidence Limits
Business access logs in an internal investigation: purpose change, employee data, roles, evidence scope, information and erasure under the GDPR.
Connected company vehicles: vehicle data and employee privacy
Connected company vehicles and telematics: GPS tracking, employee data, the Data Act, access, transparency, erasure and DPIAs.
Erasure Request on a Blockchain: Immutability, Blocking and Proof
Erasure requests for blockchain data: personal-data links, technical limits, off-chain erasure, access blocking and evidence under the GDPR.
Anonymisation and pseudonymisation: avoiding re-identification
Anonymisation and pseudonymisation under the GDPR: personal-data links, additional knowledge, EDPB criteria and evidence against re-identification.
Production Data in Software Testing: Purpose and Erasure
Production data in test and staging systems: purpose limitation, data minimisation, pseudonymisation, access controls and documented erasure under the GDPR.
Health data in workplace prevention programmes: participation and access limits
Health data in voluntary workplace prevention programmes: participation, legal basis, access limits, providers and erasure under the GDPR.
Video identification and biometric data: checking identity without excess
Video identification during contract onboarding: biometric data, legal basis, transparency, deletion and providers under the GDPR.
Cookie consent management: proof, withdrawal and consent records
How businesses record cookie consent under the GDPR, demonstrate the choice and implement a withdrawal with reliable technical blocking.
Application data after rejection: erasure, consent and talent-pool evidence
Application data after rejection: purpose expiry, erasure criteria, talent-pool consent, legal claims and evidence under the GDPR.
Whistleblowing channel and GDPR: confidentiality, access and retention
Whistleblowing channel and GDPR: how businesses separate identity, reports, access rights and retention under Austrian law.
Automated credit assessment: human review and challenge
Automated credit assessment under Article 22 GDPR: automated decisions, human review, information and an effective route to challenge.
Data protection officer independence: reporting, resources and management access
Data protection officer independence under Article 38 GDPR: reporting line, sufficient resources, budget changes and direct access to the highest management level.
Criminal-record checks in recruitment: the Article 10 GDPR special rule
Criminal-record checks in recruitment: Article 10 GDPR, the job connection, necessary scope, applicant information and access controls.
High Risk After a DPIA: Prior Consultation Before Processing Begins
When high risk after a DPIA requires prior consultation under Article 36 GDPR and which information organisations should prepare before processing begins.
Records of processing activities: how to apply Article 30 GDPR
How organisations can maintain an Article 30 GDPR record: required fields, controller and processor roles, transfers, retention periods and updates.
Fingerprint at workplace access: biometric data, alternatives and erasure
Fingerprint access at work: Article 9 GDPR, alternatives, DPIA, safeguards and erasure in the employment context.
Video surveillance in business premises: retention, access and information rights
How businesses in Austria plan lawful video surveillance, limit retention, control access and handle data subject requests concerning recordings.
Marketing objection in a CRM: How a suppression list prevents renewed contact
A marketing objection must reach CRM, newsletters and campaign systems. This article explains how to design a limited suppression list under Article 21 GDPR.
Processor data breach: notification, agreement and joint process
Processor data breach: Article 33(2) GDPR, reporting clauses, the 72-hour question and a coordinated process.
Access rights to employee data: roles, logs and controls
How to organise access rights to employee data: roles, logs, privileged accounts and regular reviews for businesses.
Joint controllership with an agency or platform: Article 26 GDPR in practice
Article 26 GDPR in practice: identify joint controllership with an agency or platform, allocate tasks and provide transparent information.
Third-country transfer with SCCs and a TIA: what businesses must document
Third-country transfers with SCCs and a TIA: the data flows, supplementary measures, legal risks and evidence businesses should document.
DPIA for New Software and AI: When Companies Must Assess in Advance
When a Data Protection Impact Assessment is required for new software or AI, which risks matter and how companies should document the review before rollout.
Erasure concept for customer and lead data: periods, holds and evidence
How organisations structure erasure concepts for customer and lead data, including purpose expiry, statutory retention, legal holds and evidence.
Article 32 GDPR: documenting security measures clearly
How to document Article 32 GDPR security measures: risk linkage, responsibilities, effectiveness testing and evidence for organisations.
SaaS agreement: controller or processor?
How businesses distinguish controllers and processors in SaaS agreements and document purposes, subprocessors, instructions and data flows.
Email to the wrong recipient: when is it a data breach?
Email to the wrong recipient: data breach assessment, containment, the 72-hour period and duties towards the authority and individuals.
Access request under Article 15 GDPR: identity, deadline and data copy
How businesses in Austria assess Article 15 GDPR access requests, verify identity, calculate the deadline and prepare a clear copy of the data.
Clarify a data protection question
Address
BRANDAUER Rechtsanwälte GmbH Giselakai 51 5020 Salzburg Österreich
Phone
+43 662 6280000