The Austrian Data Protection Authority (Datenschutzbehörde, DSB) has had a busy 2026: a landmark fine has been confirmed by the courts, new technologies are on its radar and it is carrying out focus audits. Here is what Austrian organisations need to know.
1. Supreme Administrative Court Upholds EUR 13 Million Fine
On 16 July 2026 the DSB announced that the Supreme Administrative Court (VwGH) had confirmed the unlawful processing of so-called "party affinities" — statistical estimates of individuals' likely political preferences — and set the fine at EUR 13 million. According to media reports, the case concerns Österreichische Post, whose original fine of EUR 18 million was reduced.
The lesson: derived or estimated data can be personal data — and if it reveals political opinions, it falls under the special categories of Article 9 GDPR. Marketing segments, scores and profiles must be assessed just like data collected directly.
2. Smart Glasses on the Regulators' Radar
In July 2026 the DSB published information on smart glasses, and in October 2026 the European Data Protection Board (EDPB) adopted a statement on the topic. Glasses that can record images, video and audio unnoticed raise questions about transparency, the rights of bystanders and the legal basis for recording. Organisations considering smart glasses — for example in maintenance, logistics or retail — should carry out a data protection impact assessment and set clear rules of use.
3. Focus Audits and Coordinated Enforcement
The DSB published information on its 2026 focus audit (Schwerpunktprüfung) in June 2026. At European level, supervisory authorities in the EDPB's Coordinated Enforcement Framework are checking compliance with the transparency and information obligations (Articles 12–14 GDPR) in 2026. Privacy notices that are incomplete, outdated or hard to find are an easy target.
4. EU Developments to Watch
- GDPR Procedural Regulation (EU) 2025/2518 applies from 2 April 2027 and harmonises the handling of cross-border complaints
- EDPB fining guidelines: on 21 September 2026 the EDPB adopted guidelines on when to impose fines compared with other corrective measures; public consultation runs until 13 November 2026
- Digital Omnibus: the proposed GDPR changes have not progressed in the Council, so the current GDPR continues to apply unchanged
In addition to GDPR fines, the Austrian Data Protection Act (DSG) provides for administrative penalties of up to EUR 50,000 for certain national offences.
Your Checklist
- Review profiling and segmentation for derived special category data
- Update your privacy notices for the transparency checks
- Assess new technologies such as smart glasses with a DPIA before use
- Prepare for an audit: keep your records of processing and policies up to date
How ResGuard Can Help
The ResGuard Data Protection Manager keeps your processing records, DPIAs and privacy notices audit-ready. Our external DPO service for Austria supports you in day-to-day compliance.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: announcements of the Austrian Data Protection Authority, EDPB press releases, Regulation (EU) 2025/2518 and press reports.