Austria: DSG, official secrecy and AI

What changed on 1 September 2025?

Constitutional official secrecy (Amtsverschwiegenheit) is gone. Art. 20 (3) to (5) B-VG were repealed, and the new Art. 22a B-VG and the Freedom of Information Act (IFG) have applied since then. They bring two obligations:

• Publish proactively: Information of general interest, such as studies, expert opinions and contracts worth 100,000 euros or more, belongs on the internet (§ 4 IFG). Municipalities with fewer than 5,000 inhabitants are exempt.
• Grant access on request: Anyone may request information. The authority replies within four weeks, in exceptional cases within eight (§ 8 IFG).

What stays secret?

What § 6 IFG protects stays secret, to the extent and for as long as this is necessary and proportionate. For work with AI, these grounds matter most:

Ground under § 6 (1) IFG	Example from public administration
Preparation of a decision (no. 5)	Draft of an administrative decision, internal weighing
Official or court proceedings (no. 5 lit. b)	Ongoing proceedings, audit
Protection of personal data (no. 7 lit. a)	Applications, files about citizens
Professional, trade and business secrets (no. 7 lit. b)	Bids from companies
Public order and security (no. 4)	Security concepts, deployment plans

Federal civil servants are bound to secrecy in the same cases under § 46 BDG 1979, even after their employment ends. Anyone who discloses or exploits such a fact and thereby endangers a protected interest commits a criminal offence under § 310 StGB. For staff of the federal states (Länder) and municipalities, the relevant civil service law applies.

What does this mean for AI in an authority?

Secrecy and data protection demand the same thing: information that must be kept secret must not leave the authority without control. With AI, what counts is therefore the path the data takes.

• Public AI services: Anyone who copies file contents into a freely accessible chat hands them to a provider that is often allowed to use them for its own purposes as well. For information that must be kept secret or personal data, this is out of the question.
• AI as processing on behalf: If a provider processes the data only on instruction, with a contract under Art. 28 GDPR and without using it for itself, the authority remains in control of the data. Whether this is sufficient for a specific piece of information is for your legal department and your data protection officer to assess.
• AI in your own organisation: If the AI runs on a server in your data centre, the data does not leave the building.

For the legal basis, the public sector in Austria works as in Germany: the processing must belong to a statutory task (Art. 6 (1) (e) GDPR). The Austrian Data Protection Act (DSG) supplements the GDPR and, in § 1, protects personal data as a fundamental right with constitutional status.

Must an authority release AI chat histories?

Possibly. Information within the meaning of the IFG is “any record serving official or business purposes”, regardless of its form (§ 2 (1) IFG). A chat history in which a caseworker prepares an administrative decision can fall under this. Often, however, an exception under § 6 then applies, such as the preparation of a decision or the protection of personal data. Set out what staff use the AI for and how long histories are kept.

How does this work with basebox?

basebox offers the cloud and the server in Austria. The cloud runs in a data centre in Germany, and the data processing agreement under Art. 28 GDPR is part of every contract. The server can be set up on your premises if you wish, even without an internet connection. The interface and support are available in German and English.

• Chat history: It stays in the person’s browser until they delete it.
• Logs: The audit log records who did what and when. The content of questions and answers only appears in it if your administrator turns on detailed logging.
• Permissions: The AI may never do more than the person using it. Sharing an app shares its documents, never your own access.

The data processing agreement, the TOMs and the list of sub-processors can be downloaded on /sicherheit.

Not legal advice: This article describes federal law. The federal states and municipalities are also subject to state laws and civil service law. The IFG will be evaluated by the Data Protection Authority by 2028; check the current status. Research as of 11 October 2026.