INTRA/ATAustria

What the record establishes for Austria, measure by measure, and what each source requires of the measure it governs.

Binding: 16
Recommended: 5
Reported: 0
Measures touched: 21 of 110
Sources cited: 2

Control	Source	What it establishes	Prerequisite or recommendation
16Mandatory
BA002/AT Individual risk assessmentMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A system for assessing employees needs the works council’s consent where it gathers data the operational use does not justify, and here the consent can be replaced by a decision of the conciliation board.
BA008/AT Deployment of an algorithmic system in employmentMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A system for the automated collection, processing, and transmission of a worker’s personal data beyond general particulars and qualifications needs the works council’s consent, unless what is done with the data goes no further than obligations arising from statute, collective norms, or the contract.
CP001/AT Disciplinary action on monitoring evidenceMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A workplace disciplinary code has no legal effect without the works council’s consent, so what may follow from what the program observed is settled with the workforce before any case arises.
DP007/AT Data loss prevention deploymentMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the loss prevention capability having legal effect, and the threshold is whether it touches human dignity.
DP008/AT Data loss prevention policy and tuningMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The consent that conditions the capability’s legal effect attaches to the measure as it is operated, so rules that alter what it reaches fall to be consented to as the capability itself was.
GV010/AT Worker representative engagementMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council does not consent to a control measure as a step before it, but as the condition of its legal effect. What brings a measure inside the requirement is whether it touches human dignity.
MD004/AT Endpoint activity monitoringMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the endpoint agent having legal effect, and the threshold is whether it touches human dignity.
MD005/AT Network and egress monitoringMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the traffic inspection having legal effect, and the threshold is whether it touches human dignity.
MD006/AT Electronic mail and collaboration monitoringMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the recording of the messaging platform having legal effect, and the threshold is whether it touches human dignity.
MD011/AT Privileged session recordingMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the session recorder having legal effect, and the threshold is whether it touches human dignity.
MD012/AT User and entity behavior analyticsMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the analytics engine having legal effect, and the threshold is whether it touches human dignity.
MD014/AT Video surveillance of the workplaceMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the cameras having legal effect, and the threshold is whether they touch human dignity.
MD015/AT Geolocation of vehicles and devicesMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	The works council’s consent is the condition of the tracking device having legal effect, and the threshold is whether it touches human dignity.
MD016/AT Measurement of pace and performanceMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A rate of work derived from statistical, data capture, or micro timing methods is named in its own right among the measures the works council has to consent to, alongside the general requirement for systems that control employees.
PS001/AT Pre-employment screeningMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	What needs the works council’s consent is the form put to the person: a personnel questionnaire asking beyond general particulars and the professional qualifications for the work intended. Verification carried out against a third party is not reached by it.
PS013/AT Self-declaration of changed circumstancesMandatory	Arbeitsverfassungsgesetz, sections 96 and 96aNationalrat · read 29 Aug 2026	That a control measure touching human dignity has no legal effect without the works council’s consent, and that consent for automated processing and for assessment systems can be replaced by a conciliation board while consent under section 96 cannot.	A standing route on which a worker reports about themselves becomes a personnel questionnaire once it asks beyond general particulars and qualifications, and introducing it then needs the works council’s consent.
5Recommended
DP012Retention and disposal of program recordswhere writtenRecommended	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the data protection officer either way.	Log files hold personal data in many cases, so they may be used only for purposes compatible with the one they were collected for. Where that restriction bites, the handbook says it is resolved by removing the personal data or by anonymizing them, and states that pseudonymizing them is not enough.
DP014Personal material in company accountswhere writtenRecommended	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the data protection officer either way.	There is no right for a worker to use the employer’s resources privately. Minor private or half private use within ordinary human social behavior should nonetheless be allowed or ignored, and a total prohibition pronounced only in extreme cases.
IV001Internal reporting channelwhere writtenRecommended	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the data protection officer either way.	The routes by which something conspicuous in the logs is reported onward are to be laid down, alongside the fixing of who is responsible for the evaluation that found it.
MD002Log collection and centralizationwhere writtenRecommended	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the data protection officer either way.	Logging security relevant events works as a security measure only where the data are evaluated at regular intervals by an independent reviewer. Where no independent reviewer can be put in place the administrators may do it, and the handbook states the consequence rather than leaving it: checking the administrators’ own activity then becomes hard. The evaluation is to be laid before the data protection officer or the security officer in any case, the responsibility for carrying it out is to be fixed exactly, the four eyes principle should be used in the security critical cases, and it must be ensured by technical or organizational means that the administrators’ activities can be adequately checked.
MD003Detection use case developmentwhere writtenRecommended	Österreichisches Informationssicherheitshandbuch 4.4.0Bundeskanzleramt und A-SIT · read 29 Aug 2026	That logging is only effective as a security measure once someone independent reads it, that where nobody independent can, the administrators’ own activity is what stops being checkable, and that the evaluation goes before the data protection officer either way.	The handbook sets out what an evaluation looks for: logon and logoff times outside working hours, a build-up of failed logon attempts, a build-up of impermissible access attempts, conspicuously long intervals in which nothing was logged, which points to records having been deleted, and conspicuously long intervals in which no user appears to have changed. Particular attention is to go to every access carried out under an administrator identifier.