Austria

§ 34 Abs. 1 requires essential and important entities to report significant cybersecurity incidents (defined in § 35) without delay to the responsible sector CSIRT, or to the national CSIRT if none exists, which forwards the report to the Cybersicherheitsbehörde. § 34 Abs. 2 sets four steps: an early warning within 24 hours of becoming aware, an incident notification within 72 hours, a final report within one month of that notification, and a progress report if the incident is still ongoing. Trust service providers notify within 24 hours instead of the 72-hour step.

§ 11 Abs. 1 requires companies and public-sector legal entities with 50 or more employees to set up internal reporting channels; Abs. 2 bases the threshold on the average headcount of the previous calendar year. A note on § 11 states the rules for entities with fewer than 250 employees took effect on 17 December 2023. External reports go to the BAK under § 15, unless a listed authority such as the FMA is competent.

The DSB states that processing personal data is prohibited in principle unless a legal basis applies (Arts. 5, 6 and 9 GDPR): consent (Art. 6(1)(a)), contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) or legitimate interests (Art. 6(1)(f)), while public authorities need a legal basis under Art. 6(1)(e) GDPR and § 1 DSG. It lists data subject rights of information, access, rectification, erasure, restriction, portability, objection and protection from solely automated decisions. The GDPR is directly applicable and the DSG supplements it.

The DSB states that under Art. 33 GDPR controllers must report a personal data breach to it without undue delay and where possible within 72 hours of becoming aware, with information provided in stages if needed. Notification may be omitted if the breach is unlikely to result in a risk to individuals' rights and freedoms. Notification is by online form, email or letter.

§ 23 Abs. 1 requires risk-mitigation strategies, controls and procedures proportionate to the entity's nature and size. Abs. 2 requires them to be in writing and approved by the management body, with a risk-based independent review. Abs. 3 requires a special officer (besonderer Beauftragter) who reports directly to the management body and has access to all relevant information and systems. Abs. 4 makes one management member responsible for AML/CFT compliance, and Abs. 5 requires staff knowledge and ongoing training.

§ 21 Abs. 1 requires obliged entities to keep copies of the documents and information obtained for customer due diligence and the transaction receipts and records needed to trace transactions. The text sets ten years from the end of the business relationship or from the date of an occasional transaction. Abs. 2 requires deletion afterwards unless other federal laws require or allow longer retention.

§ 4 requires obliged entities to identify and assess their money laundering and terrorist financing risks, record each step and result in a traceable way, keep the record current and give it to the FMA on request in a common electronic format. The assessment must precede the launch of new products, practices and technologies.

The FMA states financial entities must keep a register of information on ICT third-party arrangements and submit it through the Incoming Platform (2026 window: 16.02.2026 to 13.03.2026, data as of 31 December). They must inform the FMA in a timely manner about planned contracts for ICT services supporting critical or important functions and when a function becomes critical or important. The page sets no number of days.

The FMA states there is a mandatory duty to notify all major ICT-related incidents to it under Art. 19 DORA, via the FMA's Incoming Platform. Initial notification is due within four hours of classifying the incident as major and no later than 24 hours from discovery; an intermediate report follows 72 hours after the initial report; the final report is due no later than one month after the latest intermediate report.

§ 16(1) requires obliged entities to inform the Geldwäschemeldestelle without delay and on their own initiative by a Verdachtsmeldung where they know or suspect, or have reasonable grounds to suspect, assets from an offence under § 165 StGB, a breach of the trust-disclosure duty under § 6(3), or links to §§ 278a-278d StGB offences. Reports go through the secure electronic channels the FIU specifies, which its website names as goAML. § 16(3) requires credit institutions to notify the FIU of savings withdrawal requests of EUR 15,000 or more made before the § 6(1) identity check is complete; payout is possible only after seven calendar days unless the FIU orders longer.

The FMA states that crypto-asset service providers must ensure transfers can be individually identified and collect originator and beneficiary information under the Transfer of Funds Regulation, which applies in full from 30 December 2024; the transition to 31 July 2025 covers only technical limits on completeness. For transfers to or from a self-hosted wallet above EUR 1,000 the provider must check that the address belongs to or is controlled by the customer, and a customer's self-declaration alone does not suffice. Providers report repeated missing or incomplete information to the FMA. The rule sits in an EU regulation that the FMA presents as the operative text.