- Enforcing jurisdiction
- Austria · Geography does not establish applicable law.
- Confirmed applicable legislation
- No confirmed legal basis recorded.
- Privacy topics
DPA case 2025-0.620.443 – Dismissed (Austria, 2025)
Privacy enforcement record
This record is classified outside cookie consent. Subject classification does not confirm an applicable law. It is not included in cookie statistics or the Risk Calculator.
The Austrian Data Protection Authority dismissed a complaint from a company that claimed its rights were violated when a medical center linked its phone number to the managing director's name. This matters because the authority clarified that only individuals, not companies, have rights under GDPR. The managing director can still file a complaint about her own personal data if she feels it was mishandled.
What happened
A company complained that linking its phone extension to the managing director's name violated GDPR rights.
Who was affected
The managing director of the company, who filed the complaint on behalf of the company.
What the authority found
The authority ruled that the company, as a legal person, does not have standing under GDPR since it only protects natural persons.
Why this matters
This ruling highlights the limitation of GDPR protections to individuals, not companies. Small business owners should be aware that they can only file complaints regarding their own personal data rights.
Source checks
Linked-source text retrieved.
Automated check recorded — 18 October 2026.
Processing notes: national law identified.
Retrieved text may be a secondary summary or an announcement. These automated statuses do not establish that the original decision was read or that the record received an independent legal review. How we check sources
A limited liability company filed a complaint on 3 August 2025 with the Austrian Data Protection Authority (DSB) against a medical center (the controller) alleging that linking the company’s telephone extension with the name of the managing director violated GDPR rights. The complaint was lodged by the managing director, in the name of the company, meaning a legal person, not a natural person, while GDPR primarily protects natural persons in relation to personal data. The DSB did not examine whether this data processing was lawful. Instead, the DSB rejected the complaint, holding that the company, acting as data subject, does not have standing under GDPR, because it is a legal person and GDPR rights apply only to natural persons. The DSB clarified that the company is protected under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §1 of the Austrian data protection law (DSG)] only, not GDPR. Austrian law under [https://www.ris.bka.gv.at/GeltendeFassung.wxe?Abfrage=Bundesnormen&Gesetzesnummer=10001597 §1 DSG] allows some protection for legal persons, but GDPR explicitly limits rights to natural persons, with only narrow exceptions recognized by case law when personal data of a natural person appears in connection with the company, but the complaint was expressly based on the GDPR and not on that national provision. The managing director, as a natural person, retains the right to file a separate complaint if she believes her personal data rights were violated.
Outcome
Dismissed
The complaint or investigation was dismissed.
Related Enforcement Actions (0)
No other enforcement actions found for DPA case 2025-0.620.443 in AT
This is the only recorded action for this entity in this jurisdiction.
Details
About this data
Cite as: Cookie Fines. DPA case 2025-0.620.443 - Austria (2025). Retrieved from cookiefines.eu
Last updated: