Data Protection Monitor
Global Privacy & Data Protection Intelligence

Hungary Data Protection & Privacy Regulation

HU schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: Sentinel (AML/CFT), World Payments, artificial-intelligence

Last updated · 10 categories · 54 claims · 40 sources in the cumulative register

NAIH exercised binding corrective powers under GDPR Article 58(2)(d) and Privacy Act Section 56(1) against a foundation for an Article 26(1) joint-controller infringement.

Data collected Data published

AI-assembled from cited sources

Not fully checked this cycle: Data Subject Rights, Enforcement & Redress (3 open gaps).

Evidence re-verified: ·Position last changed: ·
Record history & provenance ▾

Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently.

Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26

Open in Co-Pilot ↗Build ReportCompare
Framework postureRegulated (omnibus)10 of 10 modules populated · AI-synthesised · Tier-1/2 verified
Lead supervisory authorityNemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)Primary statutory & supervisory perimeter
Next milestone (> 2026-10-26)None scheduledNo dated future statutory milestone on record
Module coverage & confidence10 / 10 modules assessed0 Confirmed · 10 Probable · 0 Uncertain

Law made at European Economic Area (Bloc) level that applies in Hungary is covered once, on the European Economic Area (Bloc) page. This page covers Hungary’s own layer: implementation, national authorities, national options and local enforcement.

Jurisdiction brief

Latest update · 25 October 2026

Lead Signal

Hungary's data-protection baseline is largely stable, with the one notable movement being new sectoral guidance from the Hungarian National Authority for Data Protection and Freedom of Information concerning banks' handling of probate-related data. A recommendation, dated 9 October 2026, is understood to state that banks must not request or retain a full probate-transfer order where a narrower data set would suffice for the purpose at hand. The authority's own primary publication was not directly quotable within the window; the finding rests on secondary Hungarian-language commentary, which supports a qualified rather than assertive characterisation of the guidance's precise terms.

Key regulatory facts for Hungary
Regulatory DimensionHungary Standing Position
JurisdictionHungary (HU)
Regulatory ScopeData Protection & Privacy Regulation (10 modules, 54 sourced findings)
Regulator & FrameworkStrong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary.
Lawful Processing & Special DataLawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding.
Data Subject RightsStrong enforcement evidence for most rights; portability sub-module unresolved.
Controller/Processor DutiesBreach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level.
Primary Instruments CitedEDPB, DataGuidance (OneTrust), DataGuidance (OneTrust), EDPB, DataGuidance (OneTrust)
Last Confirmed / Updated2026-11-04 (40 sources in cumulative register)

#

Strong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary.

Primary frameworkRegulation (EU) 2016/679 (GDPR); Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, as amended by Act XXXVIII of 2018
Supervisory authorityNemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Traffic-light rationale — GreenStrong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary.

Sub-modules (5)

Regulator And AuthorityGreen

NAIH is the confirmed national DPA.

Claims (4):

  • <cite index="3-1">Hungarian National Authority for Data Protection and Freedom of Information · Budapest Falk Miksa utca 9-11 1055 Hungary · http://www.naih.hu/ is the national supervisory authority for data protection in Hungary.
  • NAIH recommendation (published 2026-10-09) states banks must not request/retain a full probate-transfer order where a narrower data set suffices.
  • NAIH is headed by a President appointed by the President of Hungary for a nine-year term to ensure institutional independence, and holds the full range of GDPR enforcement powers.
  • NAIH is Hungary's single national authority for both data protection and freedom-of-information matters, operating under the GDPR and Act CXII of 2011 as amended.

Act And InstrumentsGreen

GDPR plus the amended Privacy Act form the dual instrument base.

Claims (1):

  • Hungary's data protection legal base is the GDPR together with <cite index="14-1">the Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information amended by Act XXXVIII of 2018, with effect of 26 July 2018, to ensure harmonisation with the GDPR.

Material ScopeGreen

Privacy Act supplements GDPR material scope on deceased persons' data and NAIH procedure.

Claims (1):

  • Beyond GDPR, the Privacy Act sets additional rules such as <cite index="5-2">rights concerning the data of the deceased and NAIH's procedural competences.

Territorial ScopeAmber

GDPR Art 3 territorial scope applies; Weltimmo v NAIH is a leading CJEU 'establishment' authority.

Claims (2):

  • EDPB territorial-scope guidance cites <cite index="58-3">Weltimmo v NAIH (C-230/14) among the leading CJEU rulings interpreting the 'establishment' concept determining GDPR applicability to Hungary-linked processing.
  • Act LXXV of 2025 — Asserts Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment

Regulator Registration And FilingGreen

DPO contact details must be communicated to NAIH per Art 37(7); no separate national controller-registration regime.

Claims (1):

  • NAIH guidance confirms that, per <cite index="9-7">Article 37(7) of the GDPR: "The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority", controllers/processors must notify NAIH of DPO contact details under the GDPR itself, not a separate Hungarian filing regime.
Category narrative 81 words

Hungary is an EU Member State applying the GDPR directly, supplemented by the national Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the 'Privacy Act'), as amended by Act XXXVIII of 2018 to harmonise with the GDPR. The Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) is the single national supervisory authority. Material and territorial scope track GDPR Arts 2-3, with the Privacy Act filling gaps outside GDPR's material scope (e.g. NAIH procedure, rights of deceased persons).

Periodic update · new data 2026-10-25

Regulator & Framework

Hungary's data-protection regulator, the National Authority for Data Protection and Freedom of Information, is understood to have issued a recommendation dated 9 October 2026 addressing banks' handling of probate-related personal data. The recommendation is reported, through secondary Hungarian-language commentary rather than a directly quotable primary text, to state that banks should not request or retain a full probate-transfer order from customers or their representatives where a narrower subset of data would be sufficient for the specific purpose the bank needs to fulfil, such as confirming an heir's entitlement to access or transfer funds in a deceased account holder's name.

This guidance sits within the authority's established supervisory role over data-controller practice in Hungary and reflects an application of the data-minimisation principle to a specific commercial sector. Because the authority's own publication could not be directly retrieved and quoted within the window, the precise scope, legal basis cited, and any accompanying enforcement posture attached to the recommendation remain to be confirmed from a primary source; reports suggest the substance of the guidance concerns proportionality between what is requested and what is operationally necessary, but the full text and any associated compliance timeline have not been independently verified here.

No change to Hungary's underlying institutional or statutory data-protection framework itself has been identified. The National Authority for Data Protection and Freedom of Information continues in its combined role as both the data-protection supervisory authority and the freedom-of-information authority for Hungary, a dual mandate that has not changed. No legislative amendment to Hungary's data-protection statute, and no change to the authority's own constitutive framework, has surfaced within the window.

Outlook

Confirmation of the precise terms, legal basis, and practical compliance expectations attached to the probate-data recommendation would require retrieval of the authority's own primary publication, which was not available in quotable form. Banks and other controllers handling estate or inheritance-related personal data in Hungary may wish to monitor for a fuller primary-source statement of the recommendation's scope as it becomes available. No other movement in Hungary's regulator-and-framework position is indicated at this time.

1 earlier distinct update(s)
Periodic update · new data 2026-10-18

Regulator & Framework

Act LXXV of 2025, in force since 1 December 2025, designates the Minister for National Economy/Enterprise Development as the AI market-surveillance authority and single point of contact under the EU AI Act, and designates the National Accreditation Authority (Nemzeti Akkreditáló Hatóság, NAH) as the AI notifying authority under Article 28. NAIH's role within this architecture is advisory and cooperating, with a delegate seat on the Hungarian AI Council rather than a lead-regulator position for AI matters. This allocation is reported with Probable confidence; it is corroborated by a Tier-2 primary-law source and a Tier-3 secondary summary, and it was published in the Magyar Közlöny as 2025 No. 127.

Government Decree 344/2025 (X.31.) implements Act LXXV of 2025, formally designating the notifying authority and market-surveillance authority roles and converting the EU AI Act's fine categories into HUF ceilings; the specific HUF figures have not been located this cycle, a gap recorded for primary-source follow-up.

Act LXXV of 2025 is also reported to assert Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment. Reports suggest this territorial-competence claim exists, although the pinpoint statutory provision has not been separately confirmed from sources reviewed this cycle, and this element is accordingly held at Uncertain confidence rather than stated assertively.

Outlook

The institutional framework is now in force, but several implementation details remain unconfirmed, principally the specific HUF fine ceilings Decree 344/2025 establishes for AI Act breaches. Confirmation of those figures, and of the pinpoint territorial-competence provision, would sharpen the practical compliance picture for AI deployers and providers interacting with the Hungarian market.

Sources and claims (9)
  1. Confirmed EDPB — <cite index="3-1">Hungarian National Authority for Data Protection and Freedom of Information · Budapest Falk Miksa utca 9-11 1055 Hungary · http://www.naih.hu/ is the national supervisory authority for data protection in Hungary. observed
  2. Confirmed DataGuidance (OneTrust) — Hungary's data protection legal base is the GDPR together with <cite index="14-1">the Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information amended by Act XXXVIII of 2018, with effect of 26 July 2018, to ensure harmonisation with the GDPR. observed
  3. Confirmed DataGuidance (OneTrust) — Beyond GDPR, the Privacy Act sets additional rules such as <cite index="5-2">rights concerning the data of the deceased and NAIH's procedural competences. observed
  4. Probable EDPB — EDPB territorial-scope guidance cites <cite index="58-3">Weltimmo v NAIH (C-230/14) among the leading CJEU rulings interpreting the 'establishment' concept determining GDPR applicability to Hungary-linked processing. observed
  5. Confirmed DataGuidance (OneTrust) — NAIH guidance confirms that, per <cite index="9-7">Article 37(7) of the GDPR: "The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority", controllers/processors must notify NAIH of DPO contact details under the GDPR itself, not a separate Hungarian filing regime. observed
  6. Probable gdpr.blog.hu — NAIH recommendation (published 2026-10-09) states banks must not request/retain a full probate-transfer order where a narrower data set suffices. observed
  7. High RecordingLaw — NAIH is headed by a President appointed by the President of Hungary for a nine-year term to ensure institutional independence, and holds the full range of GDPR enforcement powers. observed
  8. Probable Zunapro — NAIH is Hungary's single national authority for both data protection and freedom-of-information matters, operating under the GDPR and Act CXII of 2011 as amended. observed
  9. Uncertain LexLint — Act LXXV of 2025 — Asserts Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment observed

#

Lawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding.

Primary frameworkGDPR Arts 6, 7, 9; Act CXII of 2011 (amended)
Supervisory authorityNAIH
Traffic-light rationale — AmberLawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding.
D2 · Lawful Processing — Full Module Record4 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign In Partner & early-access terms →View Open Exemplar (Gibraltar)

#

Strong enforcement evidence for most rights; portability sub-module unresolved.

Primary frameworkGDPR Arts 12-22; Act CXII of 2011 §§52-61
Supervisory authorityNAIH
Traffic-light rationale — AmberStrong enforcement evidence for most rights; portability sub-module unresolved.

Sub-modules (5)

Access RightAmber

Right of access is exercisable via controllers with NAIH recourse where responses (e.g. SIRENE) are unsatisfactory.

Claims (1):

  • Under <cite index="19-1">the relevant provisions (52-61.§) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act"), data subjects may escalate unsatisfactory access responses to the Hungarian NAIH.

Rectification And ErasureGreen

NAIH has ordered erasure of unlawfully processed data in enforcement decisions.

Claims (1):

  • In a May 2024 decision, NAIH found a company had <cite index="27-4">failed to delete illegally processed data and did not provide necessary information to the applicant and ordered erasure.

Restriction And ObjectionGreen

NAIH enforcement (Forbes case) required documented balancing tests and honouring of objections.

Claims (1):

  • NAIH's Forbes decision held that a publisher must carry out a proper interest assessment and address data subjects' objections, since it <cite index="29-1">failed to carry out an individual interest assessment, the result of which would have demonstrated that data processing was justified.

Data PortabilityRed

No HU-specific portability finding beyond GDPR Art 20 baseline.

Deadlines And Response WindowsAmber

GDPR's one-month statutory response window applies directly.

Claims (1):

  • The GDPR's directly applicable one-month response deadline (Art 12(3)) governs controller responses to data-subject requests in Hungary.
Category narrative 26 words

Access, rectification/erasure, restriction/objection are all evidenced through NAIH enforcement practice. Portability carries no HU-specific derogation identified. Response-deadline obligations follow the GDPR's own one-month standard applied directly.

No periodic updates recorded in this cycle

Sources and claims (4)
  1. Probable EDPS — Under <cite index="19-1">the relevant provisions (52-61.§) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act"), data subjects may escalate unsatisfactory access responses to the Hungarian NAIH. observed
  2. Confirmed DataGuidance (OneTrust) — In a May 2024 decision, NAIH found a company had <cite index="27-4">failed to delete illegally processed data and did not provide necessary information to the applicant and ordered erasure. observed
  3. Confirmed EDPB — NAIH's Forbes decision held that a publisher must carry out a proper interest assessment and address data subjects' objections, since it <cite index="29-1">failed to carry out an individual interest assessment, the result of which would have demonstrated that data processing was justified. observed
  4. Confirmed EUR-Lex — The GDPR's directly applicable one-month response deadline (Art 12(3)) governs controller responses to data-subject requests in Hungary. observed

#

Breach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level.

Primary frameworkGDPR Arts 5, 24-32, 33-34, 35, 37-39; Act CXII of 2011 §56
Supervisory authorityNAIH
Traffic-light rationale — AmberBreach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level.
D4 · Controller & Processor — Full Module Record7 sub-modules · 52 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

BCR/SCC mechanism confirmed; adequacy sub-modules are not applicable at MS level; TIA and localisation unresolved.

Primary frameworkGDPR Chapter V (Arts 44-49)
Supervisory authorityNAIH
Traffic-light rationale — AmberBCR/SCC mechanism confirmed; adequacy sub-modules are not applicable at MS level; TIA and localisation unresolved.
Periodic update · new data 2026-09-21

Cross-Border & Adequacy

The European Union has adopted Regulation (EU) 2025/2518, which lays down additional procedural rules for the enforcement of the GDPR in cross-border cases, and which becomes applicable from April 2027. This is a High-confidence finding, and its regulatory stage is enacted-but-not-yet-effective: the regulation exists as adopted EU law but does not yet govern how data protection authorities, including NAIH, cooperate on cross-border enforcement matters. Once applicable, the regulation will introduce additional procedural rules shaping how NAIH cooperates with other EU data protection authorities on cases involving controllers or processors operating across multiple member states.

No other cross-border or adequacy development was identified for Hungary this cycle beyond this EU-level procedural instrument; this brief does not extend to Hungary-specific adequacy decisions or transfer-mechanism developments, none of which were located in the sources reached this cycle.

Outlook

Because Regulation (EU) 2025/2518 does not become applicable until April 2027, no immediate operational change to NAIH's cross-border cooperation practice is expected before that date. The item to watch over the intervening period is whether NAIH or the European Data Protection Board issues implementing guidance ahead of the April 2027 application date.

D5 · Cross-Border & Adequacy — Full Module Record6 sub-modules · 56 words · 3 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Meaningful telecoms/employment/education evidence; financial-sector detail unverified; health/credit/insurance unresolved.

Primary frameworkGDPR plus sectoral instruments (Act CVIII of 2001 on electronic commerce; labour-law/IT-policy practice)
Supervisory authorityNAIH
Traffic-light rationale — AmberMeaningful telecoms/employment/education evidence; financial-sector detail unverified; health/credit/insurance unresolved.
Periodic update · new data 2026-10-18

Sectoral Watch

The Magyar Nemzeti Bank (MNB) has been designated a sectoral AI market-surveillance authority, retaining surveillance of AI deployed in financial services under the institutional framework established by Act LXXV of 2025. This sectoral designation connects directly to GDPR supervisory activity: NAIH is understood to have prioritised the banking sector's deployment of AI, and its related GDPR compliance questions, through a thematic review announced for 2026. The overlap between an AI Act sectoral authority (MNB) and a GDPR thematic-review priority (NAIH, banking AI) indicates that financial-services firms deploying AI systems that process personal data in Hungary face oversight from two institutional directions on related but distinct legal bases: AI Act conformity requirements enforced through the AI Act institutional architecture, and GDPR lawfulness and accountability requirements enforced through NAIH's ordinary GDPR powers.

This is reported with Probable confidence, sourced to secondary commentary rather than a primary MNB or NAIH announcement; the precise scope and timeline of the 2026 thematic review has not been independently confirmed.

Outlook

The 2026 thematic review of banking-sector AI use is the concrete marker to watch: its findings, once published, would be the first visible evidence of how NAIH's GDPR powers and MNB's sectoral AI Act role interact in practice for financial-services AI deployments. A separate marker on a different sectoral question — Hungary's designation of a national competent authority under the EU Data Act — remains at the proposed stage, expected around 2027-Q2, and would represent a further sectoral institutional allocation if and when it proceeds.

Periodic update · new data 2026-09-21

Sectoral Watch

NAIH's principal sectoral signal this cycle is a thematic review of artificial-intelligence deployment in Hungary's banking sector. The review examined training-data sourcing, model-accuracy validation, pseudonymisation and anonymisation practices, and controls against unauthorised or ungoverned ('shadow') AI use within banking institutions, and NAIH has signalled that further large-scale sectoral reviews are planned during 2026. This is a High-confidence finding for the review itself, though whether the signalled additional 2026 reviews beyond banking have actually commenced was not confirmed this cycle.

Reading this development through a sectoral-watch lens rather than the algorithmic-governance lens applied elsewhere in this cycle's coverage, the material point is NAIH's choice of the banking sector as its opening thematic focus: banking is both a systemically important sector and one in which AI deployment for credit decisioning, fraud detection and customer-risk scoring is already widespread.

Outlook

The item to watch is which sector NAIH selects for its next signalled thematic review during 2026, and whether the banking-sector review's specific findings are published in a form that gives other sectors advance notice of NAIH's supervisory expectations before their own turn comes.

D6 · Sectoral Watch — Full Module Record7 sub-modules · 68 words · 5 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Only direct_marketing sub-module has confirmed evidence; the remaining five sub-modules are unresolved gaps.

Primary frameworkePrivacy Directive as implemented via Act CVIII of 2001 on electronic commerce; GDPR
Supervisory authorityNAIH
Traffic-light rationale — RedOnly direct_marketing sub-module has confirmed evidence; the remaining five sub-modules are unresolved gaps.
Periodic update · new data 2026-10-11

AdTech & Commercial Privacy

A third-party fine-tracking aggregator reports that NAIH issued three fines related to cookies and tracking technologies for missing information, totalling HUF 27,000,000, in a period the aggregator identifies as 2026 up to 1 October, following no recorded fines of this type in either 2024 or 2025. This would represent the first recorded cookie/tracker enforcement activity from NAIH in the tracked three-year window if confirmed. The exact decision dates of these three fines have not been confirmed against NAIH's own published decision database, so it remains unclear whether any of the three decisions fall specifically within the most recent research window running from 21 August to 11 October 2026.

If the reported tally is accurate, it would mark a shift in NAIH's enforcement focus toward the cookie-consent and tracking-technology space, an area that has historically drawn more enforcement attention from larger EU data protection authorities than from NAIH specifically. The underlying legal basis for such fines would ordinarily rest on the ePrivacy framework as implemented in Hungary alongside GDPR's transparency and lawful-basis requirements for any personal data processed via trackers, though the specific legal basis cited in these three decisions was not available from the aggregator source reviewed this cycle.

Outlook

The item to confirm is whether NAIH's own decision database corroborates the aggregator's reported tally and, if so, the specific dates and legal grounds of each of the three cookie-related fines. Confirmation that any fall within the most recent research window would elevate this from a standing watch item to a dated enforcement development.

Periodic update · new data 2026-09-21

AdTech & Commercial Privacy

NAIH conducted ex-officio inspections of 21 webshops this cycle and found recurring privacy-notice deficiencies across them. This is part of a broader enforcement-activity picture that also included 539 CCTV-related investigative proceedings, 133 formal applications and 15 ex-officio enforcement actions, though the webshop inspections are the specific finding most relevant to commercial and adtech-adjacent privacy practice: privacy notices are the primary transparency mechanism through which e-commerce operators disclose their data-processing and, where applicable, adtech and cookie-related practices to consumers. No dedicated cookie-consent-specific or adtech-platform-specific enforcement action distinct from the general privacy-notice finding was confirmed this cycle, and this brief does not infer one beyond what the source material supports.

This is an Assessed-confidence, partial-cycle finding: the fact of the inspection programme and its headline finding are confirmed, but the precise legal basis for the inspections, the specific privacy-notice deficiencies identified, and any resulting sanctions or corrective orders were not established from the sources reached this cycle.

Outlook

The item to watch is whether NAIH's webshop inspection programme is followed by a published enforcement decision or a broader sectoral report on e-commerce privacy-notice compliance, which would clarify both the legal basis for the inspections and the practical scope of the deficiencies found.

D7 · AdTech & Marketing — Full Module Record6 sub-modules · 40 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

ADM, biometric and surveillance-carveout sub-modules evidenced; AI risk-assessment detail and profiling/genetic sub-modules remain unresolved or uncertain.

Primary frameworkGDPR Art 22; GDPR Art 9 (biometrics); EU AI Act; Hungarian AI Law (2025); national security/law-enforcement acts
Supervisory authorityNAIH
Traffic-light rationale — AmberADM, biometric and surveillance-carveout sub-modules evidenced; AI risk-assessment detail and profiling/genetic sub-modules remain unresolved or uncertain.
Periodic update · new data 2026-10-18

Algorithmic, Biometric & Surveillance Governance

Act LXXV of 2025 establishes which Hungarian bodies perform the EU AI Act's Member State roles, including notifying authority, market surveillance authority, single point of contact, and sectoral competences, together with national powers for market surveillance, conformity-assessment oversight and regulatory sandboxes. Published in the Magyar Közlöny as 2025 No. 127 and in force since 1 December 2025, this is the completing instrument of Hungary's AI Act institutional architecture, reported with Probable confidence from a Tier-2 primary-law source.

Within this architecture, NAIH's function is advisory and cooperating rather than a lead algorithmic-governance role: it holds a delegate seat on the Hungarian AI Council, meaning Hungary's primary AI-oversight competences sit with the Minister for National Economy/Enterprise Development and the National Accreditation Authority rather than with the data-protection regulator. This is a structurally significant allocation for any assessment of how algorithmic and automated-decision systems that also process personal data will be supervised in Hungary: GDPR's own automated-decision-making provisions continue to apply through NAIH's ordinary powers, but the AI Act's conformity-assessment and market-surveillance machinery runs through a separate institutional track.

Outlook

The practical operation of the regulatory sandbox power that Act LXXV of 2025 establishes is a marker to watch, as is any future clarification of how NAIH's advisory AI Council seat translates into substantive input on algorithmic systems that process personal data. The specific HUF fine ceilings under Decree 344/2025 remain unconfirmed and would materially sharpen the enforcement-exposure picture for non-compliant algorithmic systems once located.

Periodic update · new data 2026-09-21

Algorithmic, Biometric & Surveillance Governance

NAIH's thematic review of AI deployment in Hungary's banking sector is this cycle's principal algorithmic-governance development. The review's four stated focus areas — training-data sourcing, model-accuracy validation, pseudonymisation and anonymisation practices, and controls against shadow-AI use — collectively describe a supervisory programme aimed at the full lifecycle of AI-system data governance within banking institutions. This is a High-confidence finding, and the interpreter has escalated this module's trajectory rating to escalating this cycle, reflecting the materiality of an active, named thematic supervisory programme rather than a general policy statement.

NAIH has also signalled further large-scale sectoral AI reviews during 2026, though whether these have commenced beyond banking was not confirmed this cycle; this brief treats the signal as a forward-looking indicator of NAIH's supervisory trajectory rather than a confirmed multi-sector rollout.

Outlook

The item to watch is the substantive outcome of the banking-sector review — whether it results in published findings, guidance, or enforcement action — and whether NAIH's signalled further reviews materialise in a specific additional sector during 2026, which would be the clearest indicator that algorithmic governance has become a standing NAIH supervisory priority rather than a single-sector initiative.

D8 · AI, Biometrics & Automated — Full Module Record6 sub-modules · 62 words · 6 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Partial evidence on age/consent and one concrete education-adjacent enforcement matter; three sub-modules unresolved.

Primary frameworkGDPR Art 8; Act CXII of 2011 (amended)
Supervisory authorityNAIH
Traffic-light rationale — AmberPartial evidence on age/consent and one concrete education-adjacent enforcement matter; three sub-modules unresolved.
D9 · Children's Privacy — Full Module Record5 sub-modules · 48 words · 2 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)

#

Strong evidence on powers, enforcement activity, and private redress; funding/capacity and collective-redress sub-modules unresolved; recent-developments window carries only an uncertain, borderline-dated item.

Primary frameworkGDPR Arts 58, 77-84; Act CXII of 2011 §56
Supervisory authorityNAIH
Traffic-light rationale — AmberStrong evidence on powers, enforcement activity, and private redress; funding/capacity and collective-redress sub-modules unresolved; recent-developments window carries only an uncertain, borderline-dated item.
Periodic update · new data 2026-10-18

Enforcement & Redress

NAIH's established GDPR enforcement track continued actively this cycle. NAIH fined Obuda University EUR 4,200 on 5 February 2026 for insufficient legal basis for data processing in connection with student-housing operations, a confirmed, dated enforcement action. NAIH also fined Mediaworks Hungary Zrt. HUF 50 million (approximately EUR 125,000) for intentional and unlawful processing of personal and special-category data, reported with Probable confidence as the exact decision date has not been retrieved. NAIH's standard GDPR enforcement powers remain unchanged: fines of up to EUR 20 million or 4 percent of global annual turnover, whichever is greater, alongside warnings, reprimands and processing-ban orders.

Alongside this established GDPR track, the AI Act's institutional framework under Act LXXV of 2025 and Decree 344/2025 introduces a new, parallel administrative-fine mechanism specific to AI Act breaches, converting the AI Act's EU-level fine categories into HUF ceilings. The specific HUF figures for this new mechanism have not been retrieved this cycle, so its practical severity relative to NAIH's GDPR fine powers cannot yet be compared directly. This is reported with Probable confidence pending confirmation of the decree's specific fine schedule.

Outlook

Confirmation of the HUF fine ceilings under Decree 344/2025 would allow a direct comparison between Hungary's AI Act administrative-fine exposure and its established GDPR fine exposure, sharpening the overall enforcement-risk picture for organisations deploying AI systems that also process personal data. NAIH's continuing GDPR enforcement activity, evidenced by the Obuda University and Mediaworks actions this cycle, indicates no slowdown in the established enforcement track notwithstanding the new parallel AI Act mechanism.

Periodic update · new data 2026-10-11

Enforcement & Redress

NAIH's confirmed enforcement record for 2026 includes two dated decisions predating the most recent research window. On 30 January 2026, NAIH fined the Hungarian University of Agriculture and Life Sciences EUR 4,200 for insufficient legal basis under GDPR Articles 5(1)(a) (lawfulness, fairness and transparency), 5(1)(c) (data minimisation), 6(1) (lawfulness of processing) and 13(1)-(2) (information to be provided to data subjects). A separate decision in May 2026 imposed a EUR 5,000 fine on an employer specifically for a data-minimisation failure. Both decisions sit within NAIH's general fining power under GDPR Article 83's two-tier structure, which permits fines up to EUR 20 million or 4% of global annual turnover for the higher tier, though neither of these two fines approaches that ceiling.

A further, unconfirmed signal comes from a third-party aggregator reporting three cookie/tracker-related fines totalling HUF 27,000,000 attributed to 2026, which would add to NAIH's confirmed enforcement total for the year if corroborated against NAIH's own decision database. Taken together, the confirmed January and May decisions and the reported cookie-fine tally indicate a continuing, if modest, enforcement programme spanning institutional, employment, and commercial-privacy contexts rather than concentration in any single sector.

Outlook

The item to track is whether any decision within NAIH's enforcement record, confirmed or reported, falls specifically within the ongoing research window, and whether the aggregator-reported cookie-fine tally can be corroborated against NAIH's own published decisions. Continuing enforcement activity across varied processing contexts suggests NAIH's posture remains consistently active rather than episodic.

Periodic update · new data 2026-09-21

Enforcement & Redress

NAIH's enforcement posture intensified materially this cycle. The authority fined Mediaworks Hungary Zrt HUF 50 million (approximately EUR 125,000) for intentional unlawful processing of personal and special-category political-opinion data, linked from Mediaworks' news portals to an unauthorised interactive map of political sympathisers, in breach of GDPR Articles 6(1) and 9(1). This is a High-confidence finding, though the exact NAIH decision reference and date were not located this cycle, a gap this brief flags rather than resolves by inference. The special-category nature of the data involved and the unauthorised interactive-map delivery mechanism together distinguish this case from routine security-incident enforcement.

Alongside the Mediaworks fine, NAIH recorded a substantial general enforcement-activity volume this cycle: 539 CCTV-related investigative proceedings, 133 formal applications, and 15 ex-officio enforcement actions, plus ex-officio inspections of 21 webshops that found recurring privacy-notice deficiencies. This is an Assessed-to-High-confidence composite finding sourced to a CMS GDPR Enforcement Tracker report, and it indicates NAIH sustained a high investigative tempo across CCTV and e-commerce sectors during the period, independent of the Mediaworks case specifically.

Outlook

The clearest open item is confirmation of the exact NAIH decision reference and date for the Mediaworks fine, which would allow future coverage to anchor to a primary regulatory source. A second item is whether the CCTV and webshop enforcement-volume figures represent a sustained elevated tempo or a single high-activity period, a question this brief cannot resolve without a prior-cycle baseline for comparison.

D10 · Enforcement & Redress — Full Module Record6 sub-modules · 78 words · 14 traced claims · Re-verified 2026-11-04

The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month, or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights).

Unlock with Free Pass / Sign InPartner & early-access terms →View Open Exemplar (Gibraltar)
No categories match.

Filters combine as OR inside a group and AND across groups.

Provenance and declared absence

Disclosure model: category cards load OPEN; narratives render in full; standing narratives load as a clamped teaser with an explicit “read full” control carrying the true word count. No text is hidden without disclosing how much of it there is.

Sub-modules are DP-specific nested subsections with their own real per-sub-module traffic light, rendered under each category across all regulatory modules.

Traffic-light dots are REAL data (baseline.<category>.traffic_light), not renderer-invented taxonomy, and are never suppressed -- unlike WPM, where a RAG dot would be forbidden as invented severity.

Family/accent taxonomy is renderer-level presentation config, not a JID field; it decorates the RAG dot, it does not replace it. Colour is always duplicated in text and is never the sole carrier of meaning.

Suppressed by doctrine: derived risk score. Not shown on this page.

Band honesty: uncertainty bands are computed against a frozen build clock of 2026-11-04. A year-precision row is never promoted into a tighter band.

Envelope: baseline resolved at jurisdiction_json.baseline; 10 categories, 57 sub-module(s), 54 claim(s) (54 category placement(s)), 40 source(s) in the cumulative register.

Audit trail

Machine checkChallenged on 24 Oct 2026: not upheld (8 confirmed against the cited source; 2 contradicted by the cited source; 8 could not be checked). An automated, adversarial test run by a second model; no person has assessed the result.

Think something on this page is wrong? Report an error.

GDPR article map

Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped).

Show article map
GDPR article to category mapping
ArticleCategorySub-module
Art. 5Controller/Processor Dutiesaccountability and dpia
Art. 6Lawful Processing & Special Datalawful bases
Art. 7Lawful Processing & Special Dataconsent thresholds
Art. 9Lawful Processing & Special Dataspecial categories
Art. 13Data Subject Rightsaccess right
Art. 14Data Subject Rightsaccess right
Art. 15Data Subject Rightsaccess right
Art. 16Data Subject Rightsrectification and erasure
Art. 17Data Subject Rightsrectification and erasure
Art. 18Data Subject Rightsrestriction and objection
Art. 19Data Subject Rightsrestriction and objection
Art. 20Data Subject Rightsdata portability
Art. 21Data Subject Rightsrestriction and objection
Art. 22Algorithmic, Biometric & Surveillance Governanceautomated decision making transparency
Art. 25Controller/Processor Dutiesaccountability and dpia
Art. 28Controller/Processor Dutiesjoint controller arrangements
Art. 30Controller/Processor Dutiesropa requirements
Art. 32Controller/Processor Dutiessecurity measures
Art. 33Controller/Processor Dutiesbreach notification
Art. 34Controller/Processor Dutiesbreach notification
Art. 35Controller/Processor Dutiesaccountability and dpia
Art. 37Controller/Processor Dutiesdpo requirements
Art. 38Controller/Processor Dutiesdpo requirements
Art. 39Controller/Processor Dutiesdpo requirements
Art. 44Cross-Border & Adequacytransfer mechanisms
Art. 45Cross-Border & Adequacyadequacy received
Art. 46Cross-Border & Adequacysccs and bcrs
Art. 47Cross-Border & Adequacysccs and bcrs
Art. 48Cross-Border & Adequacytransfer mechanisms
Art. 49Cross-Border & Adequacytransfer mechanisms
Art. 77Enforcement & Redressprivate right of action
Art. 78Enforcement & Redressprivate right of action
Art. 79Enforcement & Redressprivate right of action
Art. 80Enforcement & Redresscollective redress and class actions
Art. 81Enforcement & Redressregulator powers and penalties
Art. 82Enforcement & Redressregulator powers and penalties
Art. 83Enforcement & Redressregulator powers and penalties
Art. 84Enforcement & Redressregulator powers and penalties