Legal persons and data protection: confidentiality under Section 1 DSG

A legal person may rely on the protection of Section 1 of the Austrian Data Protection Act, or DSG. A GmbH, association or other organisation may therefore seek confidentiality for data concerning itself where a legitimate interest in secrecy exists.

This protection does not automatically make the organisation a data subject under the GDPR. The GDPR defines personal data by reference to identified or identifiable natural persons. The first step is therefore to identify who the information concerns and which legal basis governs its use.

Section 1(1) DSG gives “everyone” a right to secrecy regarding personal data concerning them where a legitimate interest exists. The Austrian Data Protection Authority expressly explains that this protection also covers legal persons. It can therefore apply to data concerning a GmbH, association or another organisation.

The claim concerns specific data and a legitimate interest. It is not a general label that makes every business record confidential. The assessment must ask whether the data can be linked to the legal person and whether the statutory exclusion for generally available or non-attributable data applies.

The first review should describe the information precisely. Does it concern the company itself, its internal organisation, a contract, an economic figure or information about a managing director, employee or customer? That classification determines whether Section 1 DSG, the GDPR and other protection regimes must be considered together.

Article 4(1) GDPR defines personal data as information relating to an identified or identifiable natural person. The GDPR therefore does not protect a legal person as such. A GmbH may still be a controller with duties towards the natural people whose data it processes. That organisational role is separate from its own position as a protected legal person.

A business can therefore have two different perspectives at the same time. It may claim secrecy for its own data under Section 1 DSG and, as controller, respect the GDPR rights of customers, employees or contractual partners. The first perspective does not automatically create a GDPR right of access, erasure or data portability for the legal person.

The reverse also matters. A business should not reject a natural person’s request merely because the file also concerns the company. Where the records contain information about an identifiable person, the relevant data-subject rights must be assessed separately. The [definition of personal data](/en/glossary/personal-data/) helps with this first distinction.

Section 1(1) DSG requires a legitimate interest in secrecy. The assessment looks at the specific data set and the possible consequences of its use. Calling information a trade secret does not replace the legal analysis. Conversely, data may be protected even where no single statutory category describes it.

The claim is excluded where data are generally available or cannot be linked back to the person concerned. A company-register detail that is openly accessible must therefore be assessed differently from an internal pricing strategy, an unpublished customer list or confidential technical documentation. The link to the legal person remains decisive.

The assessment must also ask whether the information really concerns the legal person or a natural person. A managing director’s name, private telephone number or personal email address may remain personal data about a natural person even when it appears in a business document. That data must not be absorbed into the company’s data merely because of the file context.

Section 1(2) DSG sets out when the right to secrecy may be restricted. The provision refers in particular to a vital interest, consent and overriding legitimate interests of another. For state interference, it also requires a statutory basis and the additional conditions stated in the provision.

For a private disclosure, the legitimate interest must be weighed against the organisation’s interest in secrecy. For a public authority, general usefulness is not enough. The specific statutory authorisation, the sensitivity of the data and the proportionality of the interference require separate consideration.

Even a permitted interference must use the least intrusive means capable of achieving the objective. The practical question may therefore be whether complete disclosure is necessary or whether a limited data set, restricted recipient group or less intrusive form is sufficient. Section 1 DSG does not create a blanket permission to release all business records.

Section 1(3) DSG gives “everyone”, subject to statutory provisions, rights to information about who processes which data, where the data came from, why they are used and to whom they are transferred. It also names rectification of inaccurate data and erasure of data processed unlawfully.

This provision must be distinguished from the GDPR data-subject rights. It does not support a blanket statement that a legal person can exercise all rights under Articles 12 to 22 GDPR in the same way as a natural person. The scope, procedure and restrictions depend on the applicable statutory rule and the particular data set.

A request should therefore be specific. Does it concern the source of company information, an inaccurate company record, an unlawful disclosure or data about a natural person? The [data-subject rights and access topic](/en/topics/data-subject-rights-access/) explains the GDPR perspective for natural people, but does not replace the Section 1 DSG assessment.

Business records often contain company data and data about natural people in the same file. A supplier agreement may identify the company as contracting party, name a contact person and include private contact details. An internal investigation may record business figures as well as statements by employees. Each item requires its own classification.

A disclosure review must therefore separate the data concerning the legal person, the data concerning natural people and the rights of third parties. Redaction may be needed for individual personal details. It does not answer the separate question whether the remaining company data are protected under Section 1 DSG.

An access request also does not automatically justify handing over the complete file. The [article on access requests containing third-party data](/en/journal/access-request-third-party-data-redaction/) explains the distinction for natural people. Company data may additionally raise company-law, contractual, competition-law or criminal-law issues that require separate review.

For a reliable assessment, record the data set, its source, the purpose of use and the planned recipient. The date of collection, previous publication, technical allocation and the question whether individual details identify a natural person may also be important.

In a disputed disclosure, preserve the original communication, recipient list, internal approval and claimed consequences. For rectification or erasure, identify which entry is inaccurate or unlawful and in which systems it appears. The [privacy governance topic](/en/topics/privacy-compliance-governance/) provides an organisational framework for these records.

The documents allow a legal assessment, but they do not decide the matter by themselves. The facts should show the link to the data, the legitimate interest in secrecy and the proportionality of any interference. Only then can a limited correction, restriction of disclosure or further step be selected responsibly.

We review whether the information concerns the legal person or natural people, whether a legitimate interest under Section 1 DSG exists and which restrictions on secrecy may be relevant. For an initial assessment, please provide the data set, its source, the planned or completed disclosure and the recipients concerned. Contact us where the distinction between business data and data-subject rights is needed for a decision.