# Arckit At Dsgvo

> [COMMUNITY] Assess Austrian DSG / DSGVO obligations — Datenschutzbehörde patterns, §§12–13 DSG special provisions, image processing (§12 DSG), and Austrian enforcement practice

- Skill: `tractorjuice/arckit-at-dsgvo` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tractorjuice/arckit-at-dsgvo`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tractorjuice/arckit-at-dsgvo/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: tractorjuice (https://skillmd.com/u/tractorjuice)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tractorjuice/arckit-at-dsgvo

---


> ⚠️ **Community-contributed command** — not part of the officially-maintained ArcKit baseline. Output should be reviewed by qualified DSB-Beauftragter / DPO / Rechtsabteilung before reliance. Citations to Datenschutzbehörde (DSB) / EU regulations may lag the current text — verify against the source. Some citations are marked `[NEEDS VERIFICATION]` and should be confirmed by an Austrian data protection practitioner before external use.

You are helping an enterprise architect generate an **Austrian Data Protection Assessment** — the Austrian-specific GDPR layer applied by the Datenschutzbehörde (DSB) under the Datenschutzgesetz (DSG 2018, BGBl. I Nr. 165/1999 as amended). Run this after `$arckit-eu-rgpd` to add Austrian obligations that go beyond the EU GDPR baseline.

## User Input

```text
$ARGUMENTS
```

## Instructions

> **Note**: Before generating, scan `projects/` for existing project directories. For each project, list all `ARC-*.md` artifacts, check `external/` for reference documents, and check `000-global/` for cross-project policies. If no external docs exist but they would improve output, ask the user.

### Step 0: Read existing artifacts from the project context

**MANDATORY** (warn if missing):

- **DATA** (Data Model) — Extract: all entities with personal data, special category data (besondere Kategorien), data subjects, data flows, retention periods, third-party processors
  - If missing: warn that an AT DSG assessment requires a data model to identify personal data categories
- **RGPD** (EU RGPD Assessment) — Extract: legal basis mapping, DPIA screening results, DPO determination, international transfer analysis
  - If missing: warn that `$arckit-at-dsgvo` should be run after `$arckit-eu-rgpd` for best results. Proceed with available data.

**RECOMMENDED** (read if available, note if missing):

- **REQ** (Requirements) — Extract: data requirements (DR-xxx), compliance requirements, authentication requirements (Bürgerkarte / Handy-Signatur / ID Austria integration)
- **STKE** (Stakeholder Analysis) — Extract: data subject categories (especially minors, patients, employees covered by ArbVG co-determination)

**OPTIONAL** (read if available, skip silently):

- **SECD** (Secure by Design) — Extract: security measures relevant to Art. 32 GDPR assessment
- **RISK** (Risk Register) — Extract: existing privacy-related risks for cross-reference

### Step 0b: Read external documents and policies

- Read any **external documents** in `external/` — extract previous DSB correspondence, Verarbeitungsverzeichnis (Art. 30 ROPA), existing Auftragsverarbeitungsverträge (DPAs), Betriebsvereinbarungen for employee data
- Read any **global policies** in `000-global/policies/` — extract Datenschutzerklärung, data retention schedule, DSB-Meldungen policy
- If a prior DSB assessment or Datenschutzerklärung is found, use it to pre-populate compliance status and identify gaps.

### Step 1: Identify or Create Project

Identify the target project from the hook context. If the project doesn't exist:

1. Use Glob to list `projects/*/` directories and find the highest `NNN-*` number
2. Calculate the next number (zero-padded to 3 digits)
3. Slugify the project name
4. Use the Write tool to create `projects/{NNN}-{slug}/README.md`
5. Set `PROJECT_ID` and `PROJECT_PATH`

### Step 2: Read Source Artifacts

Read all documents from Step 0. Identify:

- Presence of health data (Gesundheitsdaten) → triggers §§12–13 DSG + ELGA interop section
- Image/video processing (Bildverarbeitung, CCTV) → triggers §§12–13 DSG special regime
- Employee data processing → triggers ArbVG Betriebsvereinbarung: §96 Abs 1 Z 3 (control measures affecting human dignity) and/or §96a (Personaldatensysteme)
- Scientific research → triggers §§7–8 DSG (Forschungszwecke); DSB approval (Genehmigung) under §7 DSG, and the Art. 89(1) data-subject-rights exemption under §2d FOG (Forschungsorganisationsgesetz) — there is no "§2d DSG"
- Minors as data subjects → triggers §4(4) DSG (AT age of digital consent: **14 years**)
- Third-party processors in non-EEA → triggers TIA with DSB transfer focus

### Step 3: Template Reading

**Read the template** (with user override support):

- **First**, check if `.arckit/templates-custom/at-dsgvo-template.md` exists in the project root
- **If found**: Read the user's customized template
- **If not found**: Read `.arckit/templates/at-dsgvo-template.md`
- **Then read** `.arckit/templates/_partials/RENDERING.md` and resolve the `<!-- DOC-CONTROL-HEADER -->` marker in the template before writing. `ATDSG` carries the Austria regime, which hard-routes to `_partials/document-control-at.md` whatever the operator's user config says.

### Step 4: Generate AT Data Protection Assessment

**CRITICAL**: Use the **Write tool** to create the assessment document.

1. **Detect version**: Check for existing `ARC-{PROJECT_ID}-ATDSG-v*.md` files:
   - No existing file → VERSION="1.0"
   - Existing file → minor increment if refreshed, major if scope changed significantly

2. **Auto-populate Document Control**:
   - Document ID: `ARC-{PROJECT_ID}-ATDSG-v{VERSION}`
   - Status: DRAFT
   - Created Date: {current_date}
   - Next Review Date: {current_date + 12 months}
   - Classification: **Eingeschränkt** (or **Vertraulich** where criminal-law confidentiality applies); privacy assessments contain sensitive risk information.
   - Add note: "This document supplements ARC-{PROJECT_ID}-RGPD-v*.md with Austrian/DSB-specific requirements"

3. **Section 1: AT DSG Regulatory Framework**
   - Applicable texts table: DSGVO (EU 2016/679), DSG (BGBl. I 165/1999 idgF); law-enforcement/justice data processing under the **DSG 3. Hauptstück §§36–61** (transposing RL (EU) 2016/680; StPO §§134–143b apply as lex specialis); sector laws (ELGA-G for health, GTelG 2012, ArbVG §96 Abs 1 Z 3 / §96a)
   - DSB as supervisory authority — contact: dsb.gv.at
   - Austrian age of digital consent: **14 years** (§4(4) DSG, lower than GDPR default 16) — flag if minors in scope
   - Parallel BVwG (Bundesverwaltungsgericht) review pathway for DSB decisions `[NEEDS VERIFICATION: confirm current venue rules]`

4. **Section 2: §§12–13 DSG — Image and Video Processing** (conditional — only if CCTV/imagery detected)
   - ⚠️ **Disputed applicability**: the BVwG held §§12–13 DSG **inapplicable** because of the primacy of the GDPR / absence of an opening clause (BVwG W256 2214855-1, 20.11.2019; W211 2210458-1, 25.11.2019), while the OGH has continued to apply them (6 Ob 150/19f). Treat §§12–13 as **contested** and assess CCTV primarily on the GDPR (Art. 6 lawfulness, Art. 12–14 transparency); apply §§12–13 conservatively as a belt-and-braces layer, not as the settled legal basis. Confirm the current position with a practitioner.
   - §12 DSG specific lawfulness grounds for image processing (if relied on, note as contested — see above)
   - Labelling obligation (Kennzeichnungspflicht) — visible notice with responsible controller. This survives regardless of the §§12–13 dispute, as it also flows from the GDPR transparency duties (Art. 12–14)
   - Retention limit: 72 hours default under §13 DSG unless justified documented exception (contested basis; keep retention short and documented on GDPR necessity/proportionality grounds in any case)
   - Prohibition of covert imaging except narrow statutory cases
   - DSB / EDPB guidance on video processing (EDPB Guidelines 3/2019) applicability `[NEEDS VERIFICATION: confirm current guidance version]`
   - If no image processing: include section header with "N/A — no image or video processing identified"

5. **Section 3: Health Data and ELGA** (conditional — only if health data detected)
   - Elektronische Gesundheitsakte (ELGA-G) interoperability requirements
   - GTelG 2012 telematics interop for data exchange between health providers
   - Art. 9(2) GDPR legal basis selection — in AT typically §§7–8 DSG + ELGA-G
   - DPIA mandatory flag: special category data + large scale → run `$arckit-dpia`
   - Opt-out vs opt-in for ELGA participation — controller's integration obligations
   - If no health data: include section header with "N/A — no health data identified"

6. **Section 4: Employee Data (Arbeitnehmerdatenschutz)** (conditional — only if employee data in scope)
   - ArbVG Betriebsvereinbarung: employee **monitoring** measures that touch human dignity require a BV under **§96 Abs 1 Z 3** (consent-based); **Personaldatensysteme** (personnel data systems beyond general identification/qualification data) require a BV under **§96a**
   - Works council (Betriebsrat) co-determination rights
   - Data Protection Impact Assessment interface with co-determination
   - Distinction: systems touching "personal dignity" need Betriebsvereinbarung regardless of privacy level
   - If out of scope: include section header with "N/A — no employee data or no employee monitoring potential"

7. **Section 5: Scientific Research (§§7–8 DSG)** (conditional — only if research use case)
   - Research exemptions under §§7–8 DSG and Art. 89 GDPR
   - DSB approval (Genehmigung) for research/statistics processing under §7 (esp. §7 Abs 3) DSG; the exemption from Art. 89(1) GDPR data-subject rights for research sits in §2d FOG (Forschungsorganisationsgesetz), not in the DSG
   - Pseudonymisation obligations
   - Retention under research framework
   - If not applicable: include section header with "N/A — no scientific research processing identified"

8. **Section 6: Data Subject Rights (Austrian enforcement)**
   - Standard rights table (Art. 15–22 GDPR) with DSB response deadlines
   - AT practice: DSB emphasises written response quality and timeliness
   - Remedy path: complaint to DSB → appeal BVwG → VwGH/VfGH
   - Right to copy of data — DSB interpretation tends to favour broad scope `[NEEDS VERIFICATION]`

9. **Section 7: DSB Reporting and Registration**
   - Art. 30 GDPR ROPA (Verarbeitungsverzeichnis) — DSB has a documented expectation of depth
   - DPO (Datenschutzbeauftragter) mandatory triggers:
     - Public authority / public body → always mandatory
     - Large-scale systematic monitoring
     - Large-scale special category data processing
   - DPO contact reporting to DSB via dsb.gv.at portal
   - No general AT-specific registration obligation beyond EU GDPR (DSG abolished the former Datenverarbeitungsregister in 2018)

10. **Section 8: Breach Notification to DSB**
    - 72-hour notification via dsb.gv.at online form
    - Individual notification for high-risk breaches
    - Breach register maintenance requirement
    - AT enforcement practice on breach late-notification penalties `[NEEDS VERIFICATION: recent DSB penalty cases]`

11. **Section 9: International Transfers (AT context)**
    - Post-Schrems II Transfer Impact Assessment requirement — align with EDPB Recommendations 01/2020
    - EU-US Data Privacy Framework status and AT implications
    - DSB position on SCC supplementary measures `[NEEDS VERIFICATION]`

12. **Section 10: DSB Enforcement Priorities and Gap Analysis**
    - Map against DSB recent enforcement focus (cookie consent, tracking, CCTV retention, employee monitoring, HR data) `[NEEDS VERIFICATION: cite recent DSB annual report]`
    - Notable AT reference decisions for calibration `[NEEDS VERIFICATION]`
    - Consolidate gaps from all sections
    - Priority based on DSB enforcement priority and legal obligation level

Before writing the file, read `.arckit/references/quality-checklist.md` and verify all **Common Checks** pass.

Write the document to:

```text
projects/{project_id}/ARC-{PROJECT_ID}-ATDSG-v{VERSION}.md
```

### Step 5: Summary Output

```text
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ AT DSG / DSGVO Assessment Generated
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

📄 Document: projects/{project_id}/ARC-{PROJECT_ID}-ATDSG-v{VERSION}.md
📋 Document ID: {document_id}
📅 Assessment Date: {date}
🔒 Classification: Eingeschränkt (Vertraulich where criminal-law confidentiality applies)

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📊 Austrian-Specific Compliance Areas
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

| Area                            | Status       | Gaps |
|---------------------------------|--------------|------|
| §§12–13 Image/Video Processing  | {N/A or status} | {N} |
| Health Data / ELGA              | {N/A or status} | {N} |
| Employee Data / §96 Abs 1 Z 3 / §96a ArbVG | {N/A or status} | {N} |
| Research Exemptions §§7–8 DSG   | {N/A or status} | {N} |
| Age of Consent (14 years)       | {N/A or status} | {N} |
| DPO Registration with DSB       | {status}     | {N}  |
| DSB Enforcement Risks           | {level}      | {N}  |

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
⚡ Critical Actions
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

{List 🔴 High priority gaps}

Next steps:
1. {If DPIA required: Run $arckit-dpia}
2. {If employee monitoring: draft Betriebsvereinbarung §96a ArbVG}
3. {If no eu-rgpd baseline: Run $arckit-eu-rgpd first}
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
```

## Important Notes

- **Run after eu-rgpd**: This command adds the Austrian layer on top of the EU GDPR baseline. For best results, run `$arckit-eu-rgpd` first, then this command.
- **Austrian age of digital consent is 14, not 16**: Austria chose the lower limit allowed by GDPR (§4(4) DSG). Do not apply the GDPR default of 16.
- **§§12–13 DSG on image processing is contested**: AT retained a standalone image-processing regime, but the BVwG held §§12–13 DSG inapplicable for want of a GDPR opening clause (W256 2214855-1; W211 2210458-1, 2019), while the OGH still applies them (6 Ob 150/19f). Assess CCTV/imagery primarily on the GDPR and treat §§12–13 as a contested additional layer — do not present them as the settled legal basis.
- **ArbVG Betriebsvereinbarung is separate from GDPR**: Employee monitoring capability requires a works-council agreement even where GDPR lawfulness is established — §96 Abs 1 Z 3 for control measures affecting human dignity, §96a for Personaldatensysteme. Flag if employee monitoring or a personnel data system is possible.
- **Public authorities are largely exempt from GDPR fines (§30 Abs 5 DSG)**: Austria used the Art. 83(7) opening clause so the DSB cannot impose Geldbußen on Behörden, öffentliche Stellen and Körperschaften öffentlichen Rechts (corrective measures still apply). For public-sector controllers, present the Art. 83 fine ceilings as generally inapplicable — but flag that ausgegliederte / competitively-active entities may fall outside the exemption.
- **Verify citations**: Austrian data protection practice evolves through DSB decisions and BVwG case law. Items marked `[NEEDS VERIFICATION]` must be confirmed against current DSB guidance before external use.
- **Use Write Tool**: AT DSG assessments cover multiple Austrian-specific regulations and are typically 2,000–4,000 words. Always use the Write tool.

## Success Criteria

- ✅ Assessment document created at `projects/{project_id}/ARC-{PROJECT_ID}-ATDSG-v{VERSION}.md`
- ✅ Applicable DSG sections identified (§§7–8, §§12–13, §4(4); §7 DSG Genehmigung / §2d FOG research provisions as applicable)
- ✅ §§12–13 DSG image-processing regime assessed if CCTV/imagery in scope, with its contested applicability (BVwG vs OGH) flagged and GDPR treated as the primary basis
- ✅ ELGA-G / GTelG 2012 interop assessed if health data in scope
- ✅ ArbVG Betriebsvereinbarung (§96 Abs 1 Z 3 / §96a) flagged if employee monitoring or a personnel data system in scope
- ✅ §§7–8 DSG research exemptions addressed if research use case in scope
- ✅ Age of digital consent at 14 years applied (not GDPR default 16)
- ✅ DPO registration with DSB assessed
- ✅ 72-hour breach notification to DSB process assessed
- ✅ Post-Schrems II TIA requirement applied
- ✅ DSB enforcement priority self-assessment completed
- ✅ Gap analysis with prioritised action plan generated
- ✅ Document classified Eingeschränkt (or Vertraulich where criminal-law confidentiality applies)

## Example Usage

```text
$arckit-at-dsgvo Austrian DSG layer for 001 — federal ministry HR system with CCTV at entrances, employee data, and potential monitoring of IT usage

$arckit-at-dsgvo Assess AT DSG obligations for a Vienna regional hospital group integrating with ELGA, processing Gesundheitsdaten, planning mobile patient portal

$arckit-at-dsgvo AT data protection for a research consortium processing pseudonymised health data for a longitudinal cohort study under §§7–8 DSG
```

## Suggested Next Steps

After completing this command, consider running:

- `$arckit-dpia` -- Run a full Data Protection Impact Assessment if AT DSB screening flags high risk *(when 2+ AT DPIA criteria triggered or DSB published Blacklist applies)*
- `$arckit-eu-rgpd` -- Run the pan-EU GDPR baseline first if not already completed *(when No prior eu-rgpd assessment exists for this project)*
- `$arckit-at-nisg` -- Assess NISG obligations where personal data is processed by Essential/Important entities *(when Entity potentially qualifies as Essential or Important under NISG)*