The Austrian Data Protection Authority (DSB) has announced its 2026 focus audits will concentrate on processing security requirements as mandated by Article 32 of the GDPR. This includes risk assessments and associated documentation obligations under Articles 30 and 35. The DSB plans to initiate proceedings against selected controllers and processors in March 2026. A second phase of the audit, with its specific focus to be announced in June 2026, will also incorporate the European Data Protection Board's annual Coordinated Enforcement Framework questionnaire.

Regulated entities, particularly controllers and processors of personal data in Austria, should prepare for these audits by reviewing and documenting their data processing security measures, risk assessments, and related documentation. While specific deadlines for individual entities are not provided, the initiation of procedures in March 2026 indicates a need for proactive internal review and preparation. Failure to comply with GDPR processing security requirements could lead to scrutiny and potential enforcement actions by the DSB.