A German court decision on background checks has clear consequences for employers in Austria under the GDPR and national data protection law.


A German court ruling is making waves in Austria too. The Regional Labor Court Düsseldorf ordered a university to pay 1,000 euros in damages after it googled a job applicant without telling him. Because the GDPR applies directly in Austria as well, the ruling matters for Austrian employers too.

The case from Germany

A public university had researched an applicant online and found a Wikipedia entry referencing a criminal conviction without informing him beforehand. The court awarded the applicant damages under Article 82 GDPR in a ruling dated 10 April 2024 (case no. 12 Sa 1007/23).

What applies in Austria: GDPR, the DSG, and the data protection authority

The GDPR applies directly in Austria as well, supplemented by the national Data Protection Act (DSG). When it comes to background checks, Austria's data protection authority focuses on two things in particular: the duty to inform applicants and a clear division of roles between the company and the screening provider under Article 28 GDPR.

Common mistakes in background checks

Many companies only inform applicants after making an offer, or not at all. Others rely on a blanket clause in the application form. According to the German ruling, neither is enough, and the same standard is unlikely to hold up in Austria either.

How companies in Austria can screen compliantly

Swiss provider Validato, which is also active in Austria, informs candidates about the modules, sources, and purpose of a screening before it begins, and only then collects documented consent.


On top of that, companies need a data processing agreement under Article 28 GDPR with their screening provider. Without one, Austria treats this as a formal violation, regardless of what the check actually finds.