Three months without a procedural update: requesting information from the DPA

A person who has filed a complaint with the Austrian Data Protection Authority should not have to wait indefinitely for any information. Section 24(7) of the Austrian Data Protection Act, or DSG, requires the complainant to be informed within three months of filing about the status and outcome of the investigation. If that information is missing, Section 24(8) DSG opens a route to the Federal Administrative Court.

The three-month rule concerns complaint proceedings before the supervisory authority. It must be kept separate from the one-month period for an Article 15 GDPR access request addressed to a controller and from the general duty to decide. The filing date, previous correspondence and a clear timeline are central to the next assessment.

Section 24(7) DSG requires the Austrian Data Protection Authority to inform the complainant within three months of filing about the status and outcome of the investigation. The rule creates an information duty in ongoing complaint proceedings. It does not say that the substantive assessment must be completed within those three months.

Section 24(8) DSG links a judicial remedy to that duty. Any data subject may approach the Federal Administrative Court if the authority has not dealt with the complaint or has failed to inform the person within three months about the status or outcome of the complaint. The relevant starting point is therefore an actual complaint proceeding before the authority.

The complaint route under Section 24 DSG should be kept separate from the general data-subject rights and complaint process. The file must show that this is a complaint already filed with the authority, rather than a general report or suggestion for ex officio supervision.

The period starts when the complaint is filed with the Data Protection Authority. Keep the submitted version, the date of transmission, a confirmation of receipt and the authority file number. For electronic filing, the transmission confirmation and the submitted attachments should also be kept in the procedural file.

Section 24(2) DSG lists the content of a complaint. It includes the right said to have been infringed, the respondent, the facts, the reasons for the alleged unlawfulness, the request for a finding and the information needed to assess timeliness. Under Section 24(3) DSG, the underlying request and any response from the respondent should be attached where appropriate.

An Article 15 GDPR access request has a different starting point and a different addressee. Its one-month period generally applies to the controller. Section 24(7) DSG concerns the later information given by the supervisory authority after a complaint has been filed.

A message about the status of the investigation answers where the proceeding currently stands. It is not automatically the final decision on the alleged infringement. A letter about the outcome of the investigation may, however, contain substantial procedural information even where further formal steps remain.

Section 27(1) DSG provides that the Federal Administrative Court decides through a panel on complaints concerning a breach of the information duty under Section 24(7) DSG and the authority’s duty to decide. The provision identifies the court’s jurisdiction and form of decision. It does not guarantee a particular result in the original complaint.

The distinction also matters for later letters. A respondent’s later delivery may change the subject of the proceeding or lead to a hearing on whether the complaint has become devoid of purpose. The article on a supplementary data copy in DPA proceedings explains that separate procedural situation.

A reliable assessment needs a short, complete chronology. It should include the original data protection issue, the underlying request, the filing of the complaint, the confirmation of receipt, the file number and every later message from the authority. Questions and replies should also be recorded with their dates and content.

Review every authority letter for three points: Does it clearly concern the correct proceeding? Does it report the status or outcome of the investigation? Does it request a specific further step, such as a statement or a document? An automatic confirmation of receipt will generally not answer these questions.

Under Section 24(3) DSG, the underlying request and any response from the respondent may be relevant to the complaint. These records help identify the subject matter. They do not replace proof of when the authority dealt with the complaint and what information was missing afterwards.

Under Section 24(8) DSG, the data subject may approach the Federal Administrative Court if the authority has not dealt with the complaint or if the three-month information is missing. The procedural history must be documented before taking this step. The link between the complaint, the filing date and the missing information is decisive.

Section 27(1) DSG provides for a panel decision on complaints concerning the information duty and the authority’s duty to decide. The following subsections address the panel’s composition and expertise. The precise procedural requirements and the appropriate request must be checked against the file in the individual case.

This remedy addresses procedural inactivity or a breach of the authority’s information duty. It does not automatically decide every question about the original processing. The alleged infringement, the request made to the authority and the requested next procedural step should therefore be stated separately.

Section 24(4) DSG concerns the first filing of the data protection complaint. The right to have a complaint dealt with expires if it is not filed within one year after the complainant learned of the event, and in any event no later than three years after the alleged event. These limits concern the timeliness of the original complaint.

Section 24(7) DSG begins at a later point. Its three months run from the filing of the complaint and concern information about the status and outcome of the investigation. Confusing the two rules can produce the wrong starting date and an unclear procedural file.

The provisions also do not make a general statement about civil damages limitation or other administrative proceedings. The one-month period for an Article 15 GDPR data copy belongs to another assessment as well. Each right, addressee and triggering event should be recorded separately.

The preparation can follow four questions: When was the complaint filed? What was its subject? Which messages arrived afterwards? Which information about the status or outcome is missing after three months? This order keeps facts, procedural position and requested relief separate.

Use the complete correspondence rather than isolated excerpts. A letter from the authority may set a period, request a statement or ask for additional material. Its content determines whether an information duty has been met and which next step is useful.

A structured file also matters for a respondent business. Records of the original request, the response and the communication with the authority show what is actually to be decided. The topic on privacy governance in business provides an additional organisational framework for these records.

We review the filed data protection complaint, proof of receipt, the authority correspondence and the three-month period together. This shows whether the information duty under Section 24(7) DSG has been met and which step under Section 24(8) DSG may be relevant. The complete complaint file and all letters from the authority are needed for the initial review.