One-year deadline for data protection complaints

Mar 19, 2026 Benn-Ibler Rechtsanwälte

The Austrian Administrative Court (Verwaltungsgerichtshof, hereinafter VwGH) reviewed whether the one-year deadline specified in Section 24(4) of the Austrian Data Protection Act (Datenschutzgesetz, hereinafter DSG) under national procedural law aligns with European Union law, particularly Article 77 of the General Data Protection Regulation (GDPR).

Data protection complaint lodged after more than a year

In the case at hand, the appellant had submitted a data protection complaint to the Austrian data protection authority, DSB under Article 77 of the GDPR, asserting that their right to confidentiality had been compromised due to a bank employee'’ use of the appellant's professional email address for a personal matter.

The data protection authority denied the complaint in its official decision. At the time of filing, the appellant had been cognizant of the data protection breach for more than one year. Consequently, the one-year statutory period for raising such complaints had elapsed, resulting in the appellant’s claim being deemed expired.

In its disputed decision, the Austrian Federal Administrative Court (Bundesverwaltungsgericht, BVwG) rejected the appellant’s objection to the ruling.

The one-year period complies with the requirements of European Union legislation

The VwGH noted that, while Article 77 GDPR does not specify a timeframe for exercising the right of appeal, Member States retain procedural autonomy in establishing mechanisms for enforcing EU law. Such regulations must remain consistent with the EU legal principles of equivalence and effectiveness.

The VwGH found no breach of the principles of equivalence or effectiveness. The time limit stipulated in Section 24(4) of the DSG applies uniformly, whether the allegation concerns a violation of the GDPR or the DSG. Furthermore, the exercise of Union law is neither rendered impossible nor unduly burdensome, as the limitation period commences only upon notification of the data protection infraction, and the process for filing a complaint remains accessible and straightforward.

Accordingly, the VwGH found that the subjective time limit stipulated in Section 24(4) of the DSG is consistent with Union law.

VwGH Ro 2023/04/0028 (17 December 2025)