The GDPR and the Austrian Data Protection Act
The GDPR applies in Austria as everywhere in the EU. The Austrian Data Protection Act (DSG) contains its own sections on image processing (§§ 12 and 13 DSG), including a rule of thumb that recordings are deleted after 72 hours unless a longer period is justified. How far these national sections still apply alongside the GDPR is debated, so treat them as guidance for proportionality and documentation, and check the current position with your data protection officer.
This page is general information, not legal advice. The assessment for your site stays with your data protection officer and, where needed, your lawyer.
Control measures need consent
Austrian labour law is stricter than German law on one point: control measures and technical systems that affect human dignity need a works agreement before they are introduced (§ 96(1) no. 3 ArbVG). Where there is no works council, each employee's consent is needed (§ 10 AVRAG). Systems that process employee data can additionally require an agreement under § 96a ArbVG.
Cameras that can see employees are usually treated as such control measures. As in Germany, the answer lies in the configuration: events instead of people, no identification, no performance figures, short retention.
The EU AI Act applies in full
Austria is an EU member state, so the EU AI Act applies as in Germany: emotion recognition at work has been prohibited since February 2025, and high-risk obligations for biometric identification and employee evaluation apply from 2 December 2027. See the main guide for the table.
ProDataAI Lens at Austrian sites
ProDataAI Lens runs in an EU cloud environment, in your own cloud or on your premises, with support from Germany and a contract with ProDataAI under German law. Our data protection and security pack is written for German law; for Austrian sites, your data protection officer adapts it to the DSG and the ArbVG.
Frequently asked questions
Does the 72-hour rule apply in Austria?
The DSG mentions 72 hours as the standard period for image recordings unless a longer period is justified. Its relationship with the GDPR is debated; as a rule of thumb for proportionality, it is widely used.
Do we need employee consent for cameras in Austria?
Where there is a works council, a works agreement is needed for control measures affecting human dignity. Without a works council, each employee's consent is needed.
Is the German works agreement template usable in Austria?
As a starting point for content, yes, but it has to be adapted to the ArbVG and checked by your advisers.