Right to lodge a complaint
Every data subject has the right to lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde) if they deem that the processing of their personal data violates the General Data Protection Regulation (GDPR) or the Fundamental Right to Confidentiality under § 1 of the Austrian Data Protection Act (DSG) or certain provisions of Section of the DSG.
The possibility to file a complaint is the most important legal remedy provided for data subjects. According to its classification under Austrian procedural law, a complaint constitutes a formal legal remedy application. Therefore, it must meet certain procedural requirements. The Austrian Data Protection Authority offers templates for submitting complaints. The provided templates are bilingual (German and English) and help ensure that the complaint meets legal requirements.
Forms (German/English) »
A complaint can be submitted via email to dsb@dsb.gv.at or by post to the Austrian Data Protection Authority, Barichgasse 40-42, 1030 Vienna.
If the templates are not used, it is important to ensure that the complaint includes the following elements, as required by § 24(2) and (3) DSG:
1. a description of the right that is believed to have been violated,
2. where reasonable, identification of the legal entity or body allegedly responsible for the violation (the respondent),
3. the facts from which the alleged violation arises,
4. the reasons supporting the claim of unlawfulness,
5. a request for a determination that a violation of rights has occurred, and
6. the information necessary to assess whether the complaint was submitted in due time.
Furthermore, the complaint shall, where applicable, be accompanied by the original request (and any response received from the respondent. For example, if you requested the erasure of your data and then decide to lodge a complaint, you should also send the Austrian Data Protection Authority a copy of your erasure request and any response you may have received from the respondent.
Finally, it is important to note § 24(4) DSG, which states that the right to have a complaint processed expires if the complainant does not file the complaint within one year of becoming aware of the alleged violation, and at the latest within three years of the date on which the alleged violation occurred. Complaints submitted after these deadlines must be dismissed as inadmissible. For example, if a request for access was submitted in 2023 and a complaint regarding the failure to respond to this request is filed in 2025, the complaint would be considered late and must be rejected. However, this does not affect the right to submit a new request for access.