Espionage is first and foremost a security problem. After an incident, it quickly becomes a question of responsibility. Three areas of law play a particular role for companies in Austria.
Duty of care and liability
Under section 84 AktG (Austrian Stock Corporation Act), members of the management board of a stock corporation must exercise the care of a prudent and conscientious manager and are liable to the company for any breach of duty. For managing directors of a GmbH, section 25 GmbHG sets the standard of a prudent businessperson. Which protective measures are required in a given case depends on the company, the sector and the threat situation.
Protection of trade secrets
Under section 26b UWG (Austrian Unfair Competition Act), information is protected as a trade secret only if, among other things, it has been subject to reasonable steps to keep it secret. The rule is based on EU Directive 2016/943. Anyone wishing to take legal action after a leak must therefore be able to show that they took protective steps beforehand. Documented training of those who hold the knowledge can be one element of such steps.
NIS 2
For entities within the scope of the NIS 2 Directive, Art. 20(2) requires members of management bodies to attend training on cybersecurity risk management. In Austria, the Directive has been transposed by the NISG 2026. The human factor is an essential part of this risk.
What follows from this
- The governing body should address the threat in a way that can be evidenced.
- Critical information and the people who hold it should be known.
- Protective measures should be documented, including on the human level.
- Incidents and contact attempts should have a clear reporting channel.
This article is general information and not legal advice. Whether, and which, obligations apply in a given case is a matter for your legal advisers.
Further reading: Section 84 AktG · Section 25 GmbHG · Section 26b UWG · NIS 2 Directive
