Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
Austria applies GDPR through the national DSG, enforced by a single national regulator (the DSB) rather than Germany's fragmented 16-state model. Its NIS2 transposition, the NISG 2026, was only passed in December 2025 and does not take full effect until 1 October 2026, well behind Germany's already-binding NIS2UmsuCG.
Content reviewed 2026-09-08 , informational, not legal advice. Confirm current requirements with the authority linked below or your own counsel.
EU-wide regulation on personal data processing, directly applicable in Austria without transposition.
SourceAustria's national data protection act, in force since 25 May 2018. Uses GDPR's national opening clauses to set Austria-specific rules; the DSB has stated it will treat provisions that conflict with GDPR as inapplicable.
SourceAustria's NIS2 transposition act, adopted 12 December 2025, published 23 December 2025. Principal provisions enter into force 1 October 2026, creating a new central authority (Bundesamt für Cybersicherheit) and expanding scope from roughly 100 critical-infrastructure operators to an estimated 4,000-5,000 entities.
Source72 hours
GDPR Article 33 applies uniformly: notify the Datenschutzbehörde without undue delay and, where feasible, within 72 hours of becoming aware of a breach.
Notify: Datenschutzbehörde (DSB)
SourcePublished legal maximums, not a personalized estimate, not legal advice.
GDPR Article 83(5)
Up to €20,000,000 or 4% of total worldwide annual turnover of the preceding financial year, whichever is higher
SourceNISG 2026
Up to €10,000,000 or 2% of worldwide annual turnover for essential entities; up to €7,000,000 or 1.4% for important entities. Separate fines of €50,000-100,000 apply for registration failures
Not yet enforceable, NISG 2026 does not enter into force until 1 October 2026. Public bodies face a naming-and-shaming regime instead of monetary fines.
SourceApplicable , as of 2026-09-08
Adopted as the NISG 2026 on 12 December 2025, published 23 December 2025, but not yet in force as of this review. Principal provisions take effect 1 October 2026, with entity registration due by 31 December 2026. Creates a brand-new central authority, the Bundesamt für Cybersicherheit. An earlier draft (NISG 2024) was rejected by the National Council in July 2024, contributing to Austria's inclusion among EU states facing infringement scrutiny over the missed October 2024 deadline.
SourceAustrian Data Protection Authority(DSB)
Visit authority siteNot yet in full. The NISG 2026 was passed on 12 December 2025, but its principal provisions only take effect on 1 October 2026, with entity registration due by 31 December 2026.
The Österreichische Datenschutzbehörde (DSB), based in Vienna, is Austria's single national GDPR supervisory authority, unlike Germany, which splits enforcement across 16 state DPAs plus the federal BfDI.
They diverge sharply. Germany's NIS2UmsuCG has been fully in force since 6 December 2025 with no transition period. Austria's NISG 2026 enters into force nearly a year later, on 1 October 2026, after an earlier draft was rejected by parliament in mid-2024.
Talk to us about scoping an engagement around your specific regulatory context.
