GDPR: Uniform Law – Different Implementation

Since May 2018, the General Data Protection Regulation (GDPR) has applied directly across Europe – in Austria as well as in Germany. This means that the core obligations for companies are identical in both countries. Nevertheless, there are national particularities that make a significant difference in practice: Austria has made use of national opening clauses through the Data Protection Act (DSG), Germany through the Federal Data Protection Act (BDSG).

Anyone operating in both countries – or employing staff in both countries – must keep both sets of rules in mind. This article gives you a practical overview.

The 7 GDPR Principles: The Foundation for Everything

Every processing of personal data must be compatible with the seven principles of the GDPR. These apply equally in Austria and Germany:

  • ✅ Lawfulness, fairness and transparency: Data may only be processed on a legal basis and in a comprehensible manner.
  • ✅ Purpose limitation: Data may only be used for the purpose for which it was collected.
  • ✅ Data minimisation: Only as much data may be collected as is necessary for the purpose.
  • ✅ Accuracy: Data must be kept up to date and correct.
  • ✅ Storage limitation: Data may not be stored for longer than necessary.
  • ✅ Integrity and confidentiality: Data must be protected by appropriate measures.
  • ✅ Accountability: The controller must be able to demonstrate compliance.

Legal Bases: When Am I Allowed to Process Data?

Without a legal basis, any data processing is unlawful. The GDPR recognises six possible legal bases (Art. 6 GDPR). In practice, three are particularly relevant for companies:

1. Consent (Art. 6(1)(a) GDPR)

The data subject gives their consent freely, in an informed manner and unambiguously. In the employment relationship, consent must be viewed critically – due to the power imbalance between employer and employee, voluntary consent is often called into question. Strict standards apply in both Austria and Germany.

2. Performance of a contract (Art. 6(1)(b) GDPR)

Processing is necessary for the performance of a contract – for example, processing bank details for payroll or address data for delivery.

3. Legitimate interests (Art. 6(1)(f) GDPR)

The controller has a legitimate interest that overrides the interests of the data subject. This balancing exercise must always be documented on a case-by-case basis and is particularly relevant in the context of employee monitoring (GPS, email monitoring, video surveillance).

Employee Data Protection: Special Obligations in the Employment Relationship

The processing of employee data is one of the most sensitive areas of the GDPR. What employers must bear in mind:

Austria: DSG and ArbVG

The Austrian Data Protection Act contains no general provision of its own on employee data protection – the processing of employee data is based directly on the GDPR, for example on the performance of the employment contract or on legal obligations. The Labour Constitution Act (ArbVG) plays a central role: control measures that affect human dignity (§ 96(1)(3) ArbVG) and certain personnel data systems (§ 96a ArbVG) require a works agreement in establishments with a works council. In establishments without a works council, such control measures require the consent of the individual employees (§ 10 AVRAG).

Germany: § 26 BDSG and § 87 BetrVG

In Germany, § 26 BDSG governs the processing of employee data. Since the CJEU judgment of 30 March 2023 (C-34/21), however, it is questionable whether the general clause in § 26(1) BDSG can serve as an independent legal basis – employers should therefore also assess their processing directly against Art. 6 GDPR. Particularly noteworthy: data may only be processed for the purpose of detecting criminal offences if there are actual indications and proportionality is maintained. Under § 87(1)(6) BetrVG, the works council has a co-determination right regarding technical equipment capable of monitoring employees – including time-tracking systems, GPS tracking and video cameras.

GPS Tracking of Employees: What Is Permitted?

GPS tracking in field operations, on company vehicles or for delivery services is widespread – but is only legally permissible under strict conditions. The following principles apply in Austria and Germany:

  • ✅ GPS tracking exclusively during working hours – not during leisure time
  • ✅ Transparent information for employees about the type, scope and purpose
  • ✅ Proportionality: The purpose must justify the tracking (e.g. route planning, proof of deployment times)
  • ✅ In Austria: works agreement in establishments with a works council (§ 96(1)(3) or § 96a ArbVG), otherwise employee consent (§ 10 AVRAG)
  • ✅ In Germany: co-determination of the works council under § 87(1)(6) BetrVG, where a works council exists
  • ✅ Continuous monitoring without specific cause is impermissible in both countries

Practical tip: Document the purpose of GPS tracking in writing, specify who has access to the location data and define deletion periods. A missing works agreement can render the entire system unlawful – even if the technology is already in use.

Video Surveillance in the Workplace

Cameras on business premises are only permitted under strict conditions. In both countries, the following applies: open video surveillance (i.e. cameras visible to employees) for legitimate purposes such as protection against break-ins or cash register monitoring can be permissible – covert surveillance is fundamentally prohibited.

In Austria, the GDPR and the DSG together with the ArbVG govern the video surveillance of employees. In establishments with a works council, a works agreement is mandatory if the surveillance affects human dignity (§ 96(1)(3) ArbVG). In Germany, an existing works council must be involved under § 87(1)(6) BetrVG. Without its consent, the recorded data may under certain circumstances be inadmissible as evidence in proceedings.

GDPR in the Home Office: Data Protection Does Not End at the Office Door

Those who work from home often process data just as sensitive as in the office – but without the physical security infrastructure of the company. Employers remain responsible for the home workplace as well. The most important measures:

  • ✅ VPN requirement for access to company systems
  • ✅ Only company-issued or MDM-secured devices for processing business data
  • ✅ Screen locks and secure passwords mandatory
  • ✅ No private cloud services (Google Drive, Dropbox, etc.) for work documents
  • ✅ Store physical documents securely – no third-party access to sensitive materials
  • ✅ Issue a data protection policy for the home office in writing and have it confirmed by the employee

The Records of Processing Activities: Mandatory for Every Business

Every company with 250 or more employees is required under Art. 30 GDPR to maintain a record of all processing activities. Smaller businesses are only exempt if their processing activities pose no risk to data subjects, are only occasional and do not involve special categories of data – in practice, this exemption hardly applies to any business.

The record must contain for each processing activity: the purpose, categories of data subjects and data, recipients, third-country transfers, deletion periods as well as technical and organisational measures (TOMs).

Data Protection Officer: When Is One Mandatory?

In Germany, a Data Protection Officer (DPO) is mandatory when at least 20 persons are permanently engaged in the automated processing of personal data (§ 38 BDSG). In Austria, the DSG does not recognise a comparable national threshold – the GDPR obligation (Art. 37) applies in cases of large-scale processing of sensitive data or systematic monitoring. Even where it is not mandatory, a voluntary appointment can be worthwhile for small and medium-sized businesses.

Fines: What Penalties Are at Stake for Violations?

The GDPR provides for substantial penalties. Depending on the severity of the violation, fines of up to €10 million or 2% of global annual turnover (for less serious violations) or up to €20 million or 4% of turnover (for serious violations such as unlawful data processing or infringement of data subjects' rights) may be imposed.

The competent supervisory authorities are the Data Protection Authority (DSB) in Austria and, for companies, the respective state data protection authorities in Germany (e.g. BayLDA, LfDI Baden-Württemberg); the Federal Commissioner for Data Protection (BfDI) is responsible for certain sectors. The German authorities coordinate in the Data Protection Conference (DSK).

Conclusion: Data Protection Is Not a Project – It Is an Ongoing Operation

GDPR compliance is not a one-off task that can simply be ticked off. Data processing activities change, new tools are added, employees come and go, home office arrangements expand. Those who understand data protection as an ongoing process – with a well-maintained record of processing activities, regular training and clear policies – protect not only their customers and employees, but also the company itself from costly consequences.

Invest in data protection before an incident occurs. The cost of a sound GDPR structure is a fraction of what a single violation can cost.