--- title: "Hungary Data Protection & Privacy Regulation | Data Protection Monitor" canonical: https://dataprotection.gi/jurisdictions/hungary/ source_html: /jurisdictions/hungary/index.html description: "Hungary data protection and privacy regulation: 10 categories, 54 claims, updated 2026-11-04. Lawful processing, data subject rights, cross-border transfer…" generated_at: 2026-11-07T14:58:19Z content_sha256: 577a65585d05772bfc7fef2a46310c14be29d092dfa755507cbd38db7cbd0345 generator: "fe-fleet/md-twin@1.0" --- # Hungary Data Protection & Privacy Regulation schema gdpri-v2 trajectory: not yet assessed regulated (omnibus) overlaps: [Sentinel (AML/CFT)](https://sentinel.gi/jurisdictions/hungary/), [World Payments](https://payments.gi/jurisdictions/hungary/), artificial-intelligence Last updated 2026-11-04 · 10 categories · 54 claims · 40 sources in the cumulative register Download report (PDF) Expand all NAIH exercised binding corrective powers under GDPR Article 58(2)(d) and Privacy Act Section 56(1) against a foundation for an Article 26(1) joint-controller infringement. Data collected 2026-11-01 · Data published 2026-11-04 AI-assembled from cited sources Not fully checked this cycle: Data Subject Rights, Enforcement & Redress (3 open gaps). Evidence re-verified: 2026-11-04 · Position last changed: 2026-11-04 · Record history & provenance ▾ Methodology & record provenance: Module confidence is derived from the underlying claims (source tier and primary excerpt retention), while statutory legal force is tracked independently. Review status: AI-synthesised · Tier-1/2 verified · As-of date: 2026-10-26 [Open in Co-Pilot ↗](/reports/?type=copilot&j=HUNGARY)[Build Report](/reports/?j=HUNGARY)[Compare](/compare/?j=HUNGARY) Framework posture Regulated (omnibus) 10 of 10 modules populated · AI-synthesised · Tier-1/2 verified Lead supervisory authority Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) Primary statutory & supervisory perimeter Next milestone (> 2026-10-26) None scheduled No dated future statutory milestone on record Module coverage & confidence 10 / 10 modules assessed 0 Confirmed · 10 Probable · 0 Uncertain 10 Categories 1 Red categories 57 Sub-modules 54 Claims 36 Tier-1 sources Traffic-light mix 1 green 8 amber 1 red (sums to 10 rendered categories; click to filter) 1 category flagged red Law made at European Economic Area (Bloc) level that applies in Hungary is covered once, on the [European Economic Area (Bloc)](/jurisdictions/european-economic-area-bloc/) page. This page covers Hungary’s own layer: implementation, national authorities, national options and local enforcement. ## Jurisdiction brief Jurisdiction lead brief 563 Full executive summary 415 ###### Latest update · 25 October 2026 #### Lead Signal Hungary's data-protection baseline is largely stable, with the one notable movement being new sectoral guidance from the Hungarian National Authority for Data Protection and Freedom of Information concerning banks' handling of probate-related data. A recommendation, dated 9 October 2026, is understood to state that banks must not request or retain a full probate-transfer order where a narrower data set would suffice for the purpose at hand. The authority's own primary publication was not directly quotable within the window; the finding rests on secondary Hungarian-language commentary, which supports a qualified rather than assertive characterisation of the guidance's precise terms. #### Other Developments The recommendation reflects a data-minimisation principle applied to a specific sectoral context. Banks handling inheritance or estate-transfer matters are understood to be expected to limit the scope of probate documentation they request and retain to what is strictly necessary for the transaction in question, rather than routinely requesting the full probate-transfer order as a matter of course. #### Cross-Monitor Connections No development has been identified that connects Hungary's data-protection posture to the Anti-Money Laundering, world payments, advennt, artificial-intelligence, or crypto monitors. #### Outlook The practical effect of the banking-sector probate-data guidance on institutional data-retention practice going forward is not yet clear from the secondary reporting available; confirmation of the recommendation's precise scope would require the authority's own primary publication, which was not retrievable in quotable form within the window. 3 earlier updates not shown here. ###### Standing brief · as of 5 August 2026 Written before the update above. Where they differ, the update is the more recent position. #### Lead Signal NAIH exercised binding corrective powers under GDPR Article 58(2)(d) and Privacy Act Section 56(1) against a foundation for an Article 26(1) joint-controller infringement. The decision found that the joint-controller cooperation agreement failed to satisfy Article 26(1). The dispute involved cross-border children's video recordings from a Slovak primary school. #### Other Developments NAIH is Hungary's national data protection supervisory authority. Hungary's regime rests on the GDPR plus Act CXII of 2011, as amended, effective 26 July 2018. NAIH fined a company HUF 10 million on 17 May 2024 for unlawful processing. In the 2020 Forbes decision, NAIH required a documented interest-assessment and objection-handling. The Budapest Tribunal reviewed that decision on petition. NAIH also approves Binding Corporate Rules under GDPR Article 47(1). The EDPB's Opinion 07/2022 recorded no concerns on a Controller BCR NAIH led. NAIH declined jurisdiction over an unsubscribe complaint, referring it to NMHH. NAIH fined an employer over IT-monitoring policy failures. NAIH reported 744 breach notifications received by 30 November 2019. NAIH is reported to have fined a bank a record HUF 250 million over AI voice-analysis practices. A claimed sectoral DPO mandate in telecoms and banking is now contested by counter-evidence. Hungary's most recent notable development is a national AI Law enacted around November 2025. #### Cross-Monitor Connections The reported bank fine's AI voice-analysis processing may carry financial-crime data-sharing significance tracked by financial-integrity and world-payments. Hungary's new AI Law and the EU AI Act's biometric risk-tiering are better tracked by the artificial-intelligence monitor. #### Outlook NAIH's enforcement record this cycle centres on the Article 26 joint-controller infringement finding. Whether Hungary imposes any sector-specific DPO mandate beyond GDPR Article 37(1) remains an open, contested question. Hungary's new AI Law and any NAIH role under the AI Act remain the clearest open question at this monitor's boundary with artificial-intelligence coverage. Read full brief · 563 words ###### Latest update · 4 November 2026 #### Regulatory Status Hungary's data protection authority, NAIH, has maintained an active enforcement posture through 2026, concentrated on the content of privacy notices rather than on data-breach response. An ex-officio sweep examined twenty-one web shops, opening proceedings against eighteen of them, and produced four published fines during the year ranging from HUF 200,000 to HUF 10,000,000. The pattern across these cases is consistent: the deficiency identified was predominantly missing or template-copied information-notice content rather than an underlying data breach or unlawful processing event. Whether any single decision within this pattern was newly published in the most recent reporting window, as distinct from reflecting the standing 2026 enforcement record, has not been confirmed, and no primary decision page from the authority itself was directly reviewed; the record rests on secondary reporting. On the available ceiling for administrative fines, the position remains the standing one set by the General Data Protection Regulation: the authority may impose fines up to the higher of twenty million euro or four percent of global annual turnover under Article 83(4) to (6). No Hungary-specific statutory amendment to that ceiling has been identified. #### Outlook The web-shop sweep suggests NAIH's near-term enforcement attention continues to fall on commercial information-notice compliance, a lower-severity but high-frequency category of action compared with breach-driven cases. Confirmation of whether a specific decision within this pattern was issued inside the current reporting window, and direct retrieval of the underlying NAIH decision text, would sharpen the picture; both remain open. 2 earlier updates not shown here. ###### Standing brief · as of 5 August 2026 #### Regulatory Status NAIH is Hungary's national data protection supervisory authority, operating under a dual GDPR and amended Privacy Act legal basis. This cycle's lead development is a binding NAIH corrective order against a foundation for an Article 26(1) joint-controller infringement. Its most recent quantified enforcement outcome is a HUF 10 million fine issued 17 May 2024. NAIH also approves Binding Corporate Rules for cross-border transfers under GDPR Article 47(1). A claimed sectoral DPO mandate in telecoms and banking is contested by multiple independent legal-guide sources. Hungary is reported to have enacted a national AI Law around November 2025, with substantive detail and any NAIH AI Act role unverified. #### Outlook Across the ten-module spine, Hungary shows active enforcement and stable cross-border transfer competence, with the AI Law and DPO-mandate questions the main open items for the next cycle. Read full brief · 415 words Key regulatory facts for Hungary Regulatory Dimension Hungary Standing Position Jurisdiction Hungary (HU) Regulatory Scope Data Protection & Privacy Regulation (10 modules, 54 sourced findings) Regulator & Framework Strong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary. Lawful Processing & Special Data Lawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding. Data Subject Rights Strong enforcement evidence for most rights; portability sub-module unresolved. Controller/Processor Duties Breach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level. Primary Instruments Cited EDPB, DataGuidance (OneTrust), DataGuidance (OneTrust), EDPB, DataGuidance (OneTrust) Last Confirmed / Updated 2026-11-04 (40 sources in cumulative register) 10 of 10 categories Signal Red Amber Green Density Comfortable Compact Expand all sources Reset all Selections OR within a group, AND across groups. Press / to search. ### Hungary: D1 Regulator & Framework5 sub-modulesGreenEnacted in forceModule confidence: Probable▾ Strong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary. Primary framework Regulation (EU) 2016/679 (GDPR); Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information, as amended by Act XXXVIII of 2018 Supervisory authority [Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)](http://www.naih.hu/) Traffic-light rationale — Green Strong T1/T2 confirmation of regulator identity, statutory basis and scope; only registration/filing nuance relies on secondary commentary. #### Sub-modules (5) #### Regulator And AuthorityGreen NAIH is the confirmed national DPA. Claims (4): - Hungarian National Authority for Data Protection and Freedom of Information · Budapest Falk Miksa utca 9-11 1055 Hungary · http://www.naih.hu/ is the national supervisory authority for data protection in Hungary. - NAIH recommendation (published 2026-10-09) states banks must not request/retain a full probate-transfer order where a narrower data set suffices. - NAIH is headed by a President appointed by the President of Hungary for a nine-year term to ensure institutional independence, and holds the full range of GDPR enforcement powers. - NAIH is Hungary's single national authority for both data protection and freedom-of-information matters, operating under the GDPR and Act CXII of 2011 as amended. #### Act And InstrumentsGreen GDPR plus the amended Privacy Act form the dual instrument base. Claims (1): - Hungary's data protection legal base is the GDPR together with the Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information amended by Act XXXVIII of 2018, with effect of 26 July 2018, to ensure harmonisation with the GDPR. #### Material ScopeGreen Privacy Act supplements GDPR material scope on deceased persons' data and NAIH procedure. Claims (1): - Beyond GDPR, the Privacy Act sets additional rules such as rights concerning the data of the deceased and NAIH's procedural competences. #### Territorial ScopeAmber GDPR Art 3 territorial scope applies; Weltimmo v NAIH is a leading CJEU 'establishment' authority. Claims (2): - EDPB territorial-scope guidance cites Weltimmo v NAIH (C-230/14) among the leading CJEU rulings interpreting the 'establishment' concept determining GDPR applicability to Hungary-linked processing. - Act LXXV of 2025 — Asserts Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment #### Regulator Registration And FilingGreen DPO contact details must be communicated to NAIH per Art 37(7); no separate national controller-registration regime. Claims (1): - NAIH guidance confirms that, per Article 37(7) of the GDPR: "The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority", controllers/processors must notify NAIH of DPO contact details under the GDPR itself, not a separate Hungarian filing regime. Hungary is an EU Member State applying the GDPR directly, supplemented by the national Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information (the 'Privacy Act'), as amended by Act XXXVIII of 2018 to harmonise with the GDPR. The Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) is the single national supervisory authority. Material and territorial scope track GDPR Arts 2-3, with the Privacy Act filling gaps outside GDPR's material scope (e.g. NAIH procedure, rights of deceased persons). Periodic update · new data 2026-10-25 #### Regulator & Framework Hungary's data-protection regulator, the National Authority for Data Protection and Freedom of Information, is understood to have issued a recommendation dated 9 October 2026 addressing banks' handling of probate-related personal data. The recommendation is reported, through secondary Hungarian-language commentary rather than a directly quotable primary text, to state that banks should not request or retain a full probate-transfer order from customers or their representatives where a narrower subset of data would be sufficient for the specific purpose the bank needs to fulfil, such as confirming an heir's entitlement to access or transfer funds in a deceased account holder's name. This guidance sits within the authority's established supervisory role over data-controller practice in Hungary and reflects an application of the data-minimisation principle to a specific commercial sector. Because the authority's own publication could not be directly retrieved and quoted within the window, the precise scope, legal basis cited, and any accompanying enforcement posture attached to the recommendation remain to be confirmed from a primary source; reports suggest the substance of the guidance concerns proportionality between what is requested and what is operationally necessary, but the full text and any associated compliance timeline have not been independently verified here. No change to Hungary's underlying institutional or statutory data-protection framework itself has been identified. The National Authority for Data Protection and Freedom of Information continues in its combined role as both the data-protection supervisory authority and the freedom-of-information authority for Hungary, a dual mandate that has not changed. No legislative amendment to Hungary's data-protection statute, and no change to the authority's own constitutive framework, has surfaced within the window. #### Outlook Confirmation of the precise terms, legal basis, and practical compliance expectations attached to the probate-data recommendation would require retrieval of the authority's own primary publication, which was not available in quotable form. Banks and other controllers handling estate or inheritance-related personal data in Hungary may wish to monitor for a fuller primary-source statement of the recommendation's scope as it becomes available. No other movement in Hungary's regulator-and-framework position is indicated at this time. 1 earlier distinct update(s) Periodic update · new data 2026-10-18 #### Regulator & Framework Act LXXV of 2025, in force since 1 December 2025, designates the Minister for National Economy/Enterprise Development as the AI market-surveillance authority and single point of contact under the EU AI Act, and designates the National Accreditation Authority (Nemzeti Akkreditáló Hatóság, NAH) as the AI notifying authority under Article 28. NAIH's role within this architecture is advisory and cooperating, with a delegate seat on the Hungarian AI Council rather than a lead-regulator position for AI matters. This allocation is reported with Probable confidence; it is corroborated by a Tier-2 primary-law source and a Tier-3 secondary summary, and it was published in the Magyar Közlöny as 2025 No. 127. Government Decree 344/2025 (X.31.) implements Act LXXV of 2025, formally designating the notifying authority and market-surveillance authority roles and converting the EU AI Act's fine categories into HUF ceilings; the specific HUF figures have not been located this cycle, a gap recorded for primary-source follow-up. Act LXXV of 2025 is also reported to assert Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment. Reports suggest this territorial-competence claim exists, although the pinpoint statutory provision has not been separately confirmed from sources reviewed this cycle, and this element is accordingly held at Uncertain confidence rather than stated assertively. #### Outlook The institutional framework is now in force, but several implementation details remain unconfirmed, principally the specific HUF fine ceilings Decree 344/2025 establishes for AI Act breaches. Confirmation of those figures, and of the pinpoint territorial-competence provision, would sharpen the practical compliance picture for AI deployers and providers interacting with the Hungarian market. Sources and claims (9) - [EDPB](https://www.edpb.europa.eu/contact/contact-dpas_en) — Hungarian National Authority for Data Protection and Freedom of Information · Budapest Falk Miksa utca 9-11 1055 Hungary · http://www.naih.hu/ is the national supervisory authority for data protection in Hungary. - [DataGuidance (OneTrust)](https://www.dataguidance.com/news/hungary-gdpr-implementation-law-comes-effect) — Hungary's data protection legal base is the GDPR together with the Act CXII of 2011 on the Right to Informational Self-Determination and Freedom of Information amended by Act XXXVIII of 2018, with effect of 26 July 2018, to ensure harmonisation with the GDPR. - [DataGuidance (OneTrust)](https://www.dataguidance.com/notes/hungary-data-transfers) — Beyond GDPR, the Privacy Act sets additional rules such as rights concerning the data of the deceased and NAIH's procedural competences. - [EDPB](https://www.edpb.europa.eu/system/files/documents/files/file1/edpb_guidelines_3_2018_territorial_scope_after_public_consultation_en_1.pdf) — EDPB territorial-scope guidance cites Weltimmo v NAIH (C-230/14) among the leading CJEU rulings interpreting the 'establishment' concept determining GDPR applicability to Hungary-linked processing. - [DataGuidance (OneTrust)](https://www.dataguidance.com/opinion/europe-register-or-not-register-dpo-contact-0) — NAIH guidance confirms that, per Article 37(7) of the GDPR: "The controller or the processor shall publish the contact details of the data protection officer and communicate them to the supervisory authority", controllers/processors must notify NAIH of DPO contact details under the GDPR itself, not a separate Hungarian filing regime. - [gdpr.blog.hu](https://gdpr.blog.hu/?token=581e1d9e0eb7ab2b6734965ec7f2c8b9) — NAIH recommendation (published 2026-10-09) states banks must not request/retain a full probate-transfer order where a narrower data set suffices. - [RecordingLaw](https://www.recordinglaw.com/world-laws/world-data-privacy-laws/hungary-data-privacy-laws/) — NAIH is headed by a President appointed by the President of Hungary for a nine-year term to ensure institutional independence, and holds the full range of GDPR enforcement powers. - [Zunapro](https://zunapro.com/hungary/en/blog/gdpr-adatvedelem-magyar-ekereskedelem) — NAIH is Hungary's single national authority for both data protection and freedom-of-information matters, operating under the GDPR and Act CXII of 2011 as amended. - [LexLint](https://lexlint.io/l/hu-2025-evi-lxxv-torveny-az-europai-unio-mesters) — Act LXXV of 2025 — Asserts Hungarian authorities' competence over any use of AI outputs within Hungary regardless of the provider's place of establishment ### Hungary: D2 Lawful Processing & Special Data4 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Lawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding. Primary framework GDPR Arts 6, 7, 9; Act CXII of 2011 (amended) Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Lawful bases and consent well evidenced; pseudonymisation/anonymisation sub-module has no HU-specific finding. D2 · Lawful Processing — Full Module Record 4 sub-modules · 45 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login) [Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D3 Data Subject Rights5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong enforcement evidence for most rights; portability sub-module unresolved. Primary framework GDPR Arts 12-22; Act CXII of 2011 §§52-61 Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Strong enforcement evidence for most rights; portability sub-module unresolved. #### Sub-modules (5) #### Access RightAmber Right of access is exercisable via controllers with NAIH recourse where responses (e.g. SIRENE) are unsatisfactory. Claims (1): - Under the relevant provisions (52-61.§) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act"), data subjects may escalate unsatisfactory access responses to the Hungarian NAIH. #### Rectification And ErasureGreen NAIH has ordered erasure of unlawfully processed data in enforcement decisions. Claims (1): - In a May 2024 decision, NAIH found a company had failed to delete illegally processed data and did not provide necessary information to the applicant and ordered erasure. #### Restriction And ObjectionGreen NAIH enforcement (Forbes case) required documented balancing tests and honouring of objections. Claims (1): - NAIH's Forbes decision held that a publisher must carry out a proper interest assessment and address data subjects' objections, since it failed to carry out an individual interest assessment, the result of which would have demonstrated that data processing was justified. #### Data PortabilityRed No HU-specific portability finding beyond GDPR Art 20 baseline. #### Deadlines And Response WindowsAmber GDPR's one-month statutory response window applies directly. Claims (1): - The GDPR's directly applicable one-month response deadline (Art 12(3)) governs controller responses to data-subject requests in Hungary. Access, rectification/erasure, restriction/objection are all evidenced through NAIH enforcement practice. Portability carries no HU-specific derogation identified. Response-deadline obligations follow the GDPR's own one-month standard applied directly. No periodic updates recorded in this cycle Sources and claims (4) - [EDPS](https://www.edps.europa.eu/system/files/2022-04/2022_04_sis_ii_guide_of_access_update_2022_en_0.pdf) — Under the relevant provisions (52-61.§) of Act CXII of 2011 on Informational Self-Determination and Freedom of Information ("Privacy Act"), data subjects may escalate unsatisfactory access responses to the Hungarian NAIH. - [DataGuidance (OneTrust)](https://www.dataguidance.com/news/hungary-naih-fines-company-huf-10m-unlawful-data) — In a May 2024 decision, NAIH found a company had failed to delete illegally processed data and did not provide necessary information to the applicant and ordered erasure. - [EDPB](https://www.edpb.europa.eu/news/national-news/2020/hungarian-dpa-fines-forbes_en) — NAIH's Forbes decision held that a publisher must carry out a proper interest assessment and address data subjects' objections, since it failed to carry out an individual interest assessment, the result of which would have demonstrated that data processing was justified. - [EUR-Lex](https://eur-lex.europa.eu/eli/reg/2016/679/oj) — The GDPR's directly applicable one-month response deadline (Art 12(3)) governs controller responses to data-subject requests in Hungary. ### Hungary: D4 Controller/Processor Duties7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Breach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level. Primary framework GDPR Arts 5, 24-32, 33-34, 35, 37-39; Act CXII of 2011 §56 Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Breach notification and joint-controller duties strongly evidenced; ROPA/security-measures sub-modules unresolved at HU-specific level. D4 · Controller & Processor — Full Module Record 7 sub-modules · 52 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D5 Cross-Border & Adequacy6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ BCR/SCC mechanism confirmed; adequacy sub-modules are not applicable at MS level; TIA and localisation unresolved. Primary framework GDPR Chapter V (Arts 44-49) Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber BCR/SCC mechanism confirmed; adequacy sub-modules are not applicable at MS level; TIA and localisation unresolved. Periodic update · new data 2026-09-21 #### Cross-Border & Adequacy The European Union has adopted Regulation (EU) 2025/2518, which lays down additional procedural rules for the enforcement of the GDPR in cross-border cases, and which becomes applicable from April 2027. This is a High-confidence finding, and its regulatory stage is enacted-but-not-yet-effective: the regulation exists as adopted EU law but does not yet govern how data protection authorities, including NAIH, cooperate on cross-border enforcement matters. Once applicable, the regulation will introduce additional procedural rules shaping how NAIH cooperates with other EU data protection authorities on cases involving controllers or processors operating across multiple member states. No other cross-border or adequacy development was identified for Hungary this cycle beyond this EU-level procedural instrument; this brief does not extend to Hungary-specific adequacy decisions or transfer-mechanism developments, none of which were located in the sources reached this cycle. #### Outlook Because Regulation (EU) 2025/2518 does not become applicable until April 2027, no immediate operational change to NAIH's cross-border cooperation practice is expected before that date. The item to watch over the intervening period is whether NAIH or the European Data Protection Board issues implementing guidance ahead of the April 2027 application date. D5 · Cross-Border & Adequacy — Full Module Record 6 sub-modules · 56 words · 3 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D6 Sectoral Watch7 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Meaningful telecoms/employment/education evidence; financial-sector detail unverified; health/credit/insurance unresolved. Primary framework GDPR plus sectoral instruments (Act CVIII of 2001 on electronic commerce; labour-law/IT-policy practice) Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Meaningful telecoms/employment/education evidence; financial-sector detail unverified; health/credit/insurance unresolved. Periodic update · new data 2026-10-18 #### Sectoral Watch The Magyar Nemzeti Bank (MNB) has been designated a sectoral AI market-surveillance authority, retaining surveillance of AI deployed in financial services under the institutional framework established by Act LXXV of 2025. This sectoral designation connects directly to GDPR supervisory activity: NAIH is understood to have prioritised the banking sector's deployment of AI, and its related GDPR compliance questions, through a thematic review announced for 2026. The overlap between an AI Act sectoral authority (MNB) and a GDPR thematic-review priority (NAIH, banking AI) indicates that financial-services firms deploying AI systems that process personal data in Hungary face oversight from two institutional directions on related but distinct legal bases: AI Act conformity requirements enforced through the AI Act institutional architecture, and GDPR lawfulness and accountability requirements enforced through NAIH's ordinary GDPR powers. This is reported with Probable confidence, sourced to secondary commentary rather than a primary MNB or NAIH announcement; the precise scope and timeline of the 2026 thematic review has not been independently confirmed. #### Outlook The 2026 thematic review of banking-sector AI use is the concrete marker to watch: its findings, once published, would be the first visible evidence of how NAIH's GDPR powers and MNB's sectoral AI Act role interact in practice for financial-services AI deployments. A separate marker on a different sectoral question — Hungary's designation of a national competent authority under the EU Data Act — remains at the proposed stage, expected around 2027-Q2, and would represent a further sectoral institutional allocation if and when it proceeds. Periodic update · new data 2026-09-21 #### Sectoral Watch NAIH's principal sectoral signal this cycle is a thematic review of artificial-intelligence deployment in Hungary's banking sector. The review examined training-data sourcing, model-accuracy validation, pseudonymisation and anonymisation practices, and controls against unauthorised or ungoverned ('shadow') AI use within banking institutions, and NAIH has signalled that further large-scale sectoral reviews are planned during 2026. This is a High-confidence finding for the review itself, though whether the signalled additional 2026 reviews beyond banking have actually commenced was not confirmed this cycle. Reading this development through a sectoral-watch lens rather than the algorithmic-governance lens applied elsewhere in this cycle's coverage, the material point is NAIH's choice of the banking sector as its opening thematic focus: banking is both a systemically important sector and one in which AI deployment for credit decisioning, fraud detection and customer-risk scoring is already widespread. #### Outlook The item to watch is which sector NAIH selects for its next signalled thematic review during 2026, and whether the banking-sector review's specific findings are published in a form that gives other sectors advance notice of NAIH's supervisory expectations before their own turn comes. D6 · Sectoral Watch — Full Module Record 7 sub-modules · 68 words · 5 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D7 AdTech & Commercial Privacy6 sub-modulesRedEnacted in forceModule confidence: Probable▾ Only direct_marketing sub-module has confirmed evidence; the remaining five sub-modules are unresolved gaps. Primary framework ePrivacy Directive as implemented via Act CVIII of 2001 on electronic commerce; GDPR Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Red Only direct_marketing sub-module has confirmed evidence; the remaining five sub-modules are unresolved gaps. Periodic update · new data 2026-10-11 #### AdTech & Commercial Privacy A third-party fine-tracking aggregator reports that NAIH issued three fines related to cookies and tracking technologies for missing information, totalling HUF 27,000,000, in a period the aggregator identifies as 2026 up to 1 October, following no recorded fines of this type in either 2024 or 2025. This would represent the first recorded cookie/tracker enforcement activity from NAIH in the tracked three-year window if confirmed. The exact decision dates of these three fines have not been confirmed against NAIH's own published decision database, so it remains unclear whether any of the three decisions fall specifically within the most recent research window running from 21 August to 11 October 2026. If the reported tally is accurate, it would mark a shift in NAIH's enforcement focus toward the cookie-consent and tracking-technology space, an area that has historically drawn more enforcement attention from larger EU data protection authorities than from NAIH specifically. The underlying legal basis for such fines would ordinarily rest on the ePrivacy framework as implemented in Hungary alongside GDPR's transparency and lawful-basis requirements for any personal data processed via trackers, though the specific legal basis cited in these three decisions was not available from the aggregator source reviewed this cycle. #### Outlook The item to confirm is whether NAIH's own decision database corroborates the aggregator's reported tally and, if so, the specific dates and legal grounds of each of the three cookie-related fines. Confirmation that any fall within the most recent research window would elevate this from a standing watch item to a dated enforcement development. Periodic update · new data 2026-09-21 #### AdTech & Commercial Privacy NAIH conducted ex-officio inspections of 21 webshops this cycle and found recurring privacy-notice deficiencies across them. This is part of a broader enforcement-activity picture that also included 539 CCTV-related investigative proceedings, 133 formal applications and 15 ex-officio enforcement actions, though the webshop inspections are the specific finding most relevant to commercial and adtech-adjacent privacy practice: privacy notices are the primary transparency mechanism through which e-commerce operators disclose their data-processing and, where applicable, adtech and cookie-related practices to consumers. No dedicated cookie-consent-specific or adtech-platform-specific enforcement action distinct from the general privacy-notice finding was confirmed this cycle, and this brief does not infer one beyond what the source material supports. This is an Assessed-confidence, partial-cycle finding: the fact of the inspection programme and its headline finding are confirmed, but the precise legal basis for the inspections, the specific privacy-notice deficiencies identified, and any resulting sanctions or corrective orders were not established from the sources reached this cycle. #### Outlook The item to watch is whether NAIH's webshop inspection programme is followed by a published enforcement decision or a broader sectoral report on e-commerce privacy-notice compliance, which would clarify both the legal basis for the inspections and the practical scope of the deficiencies found. D7 · AdTech & Marketing — Full Module Record 6 sub-modules · 40 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Red), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D8 Algorithmic, Biometric & Surveillance Governance6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ ADM, biometric and surveillance-carveout sub-modules evidenced; AI risk-assessment detail and profiling/genetic sub-modules remain unresolved or uncertain. Primary framework GDPR Art 22; GDPR Art 9 (biometrics); EU AI Act; Hungarian AI Law (2025); national security/law-enforcement acts Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber ADM, biometric and surveillance-carveout sub-modules evidenced; AI risk-assessment detail and profiling/genetic sub-modules remain unresolved or uncertain. Periodic update · new data 2026-10-18 #### Algorithmic, Biometric & Surveillance Governance Act LXXV of 2025 establishes which Hungarian bodies perform the EU AI Act's Member State roles, including notifying authority, market surveillance authority, single point of contact, and sectoral competences, together with national powers for market surveillance, conformity-assessment oversight and regulatory sandboxes. Published in the Magyar Közlöny as 2025 No. 127 and in force since 1 December 2025, this is the completing instrument of Hungary's AI Act institutional architecture, reported with Probable confidence from a Tier-2 primary-law source. Within this architecture, NAIH's function is advisory and cooperating rather than a lead algorithmic-governance role: it holds a delegate seat on the Hungarian AI Council, meaning Hungary's primary AI-oversight competences sit with the Minister for National Economy/Enterprise Development and the National Accreditation Authority rather than with the data-protection regulator. This is a structurally significant allocation for any assessment of how algorithmic and automated-decision systems that also process personal data will be supervised in Hungary: GDPR's own automated-decision-making provisions continue to apply through NAIH's ordinary powers, but the AI Act's conformity-assessment and market-surveillance machinery runs through a separate institutional track. #### Outlook The practical operation of the regulatory sandbox power that Act LXXV of 2025 establishes is a marker to watch, as is any future clarification of how NAIH's advisory AI Council seat translates into substantive input on algorithmic systems that process personal data. The specific HUF fine ceilings under Decree 344/2025 remain unconfirmed and would materially sharpen the enforcement-exposure picture for non-compliant algorithmic systems once located. Periodic update · new data 2026-09-21 #### Algorithmic, Biometric & Surveillance Governance NAIH's thematic review of AI deployment in Hungary's banking sector is this cycle's principal algorithmic-governance development. The review's four stated focus areas — training-data sourcing, model-accuracy validation, pseudonymisation and anonymisation practices, and controls against shadow-AI use — collectively describe a supervisory programme aimed at the full lifecycle of AI-system data governance within banking institutions. This is a High-confidence finding, and the interpreter has escalated this module's trajectory rating to escalating this cycle, reflecting the materiality of an active, named thematic supervisory programme rather than a general policy statement. NAIH has also signalled further large-scale sectoral AI reviews during 2026, though whether these have commenced beyond banking was not confirmed this cycle; this brief treats the signal as a forward-looking indicator of NAIH's supervisory trajectory rather than a confirmed multi-sector rollout. #### Outlook The item to watch is the substantive outcome of the banking-sector review — whether it results in published findings, guidance, or enforcement action — and whether NAIH's signalled further reviews materialise in a specific additional sector during 2026, which would be the clearest indicator that algorithmic governance has become a standing NAIH supervisory priority rather than a single-sector initiative. D8 · AI, Biometrics & Automated — Full Module Record 6 sub-modules · 62 words · 6 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D9 Children & Vulnerable Groups5 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Partial evidence on age/consent and one concrete education-adjacent enforcement matter; three sub-modules unresolved. Primary framework GDPR Art 8; Act CXII of 2011 (amended) Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Partial evidence on age/consent and one concrete education-adjacent enforcement matter; three sub-modules unresolved. D9 · Children's Privacy — Full Module Record 5 sub-modules · 48 words · 2 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ### Hungary: D10 Enforcement & Redress6 sub-modulesAmberEnacted in forceModule confidence: Probable▾ Strong evidence on powers, enforcement activity, and private redress; funding/capacity and collective-redress sub-modules unresolved; recent-developments window carries only an uncertain, borderline-dated item. Primary framework GDPR Arts 58, 77-84; Act CXII of 2011 §56 Supervisory authority [NAIH](http://www.naih.hu/) Traffic-light rationale — Amber Strong evidence on powers, enforcement activity, and private redress; funding/capacity and collective-redress sub-modules unresolved; recent-developments window carries only an uncertain, borderline-dated item. Periodic update · new data 2026-10-18 #### Enforcement & Redress NAIH's established GDPR enforcement track continued actively this cycle. NAIH fined Obuda University EUR 4,200 on 5 February 2026 for insufficient legal basis for data processing in connection with student-housing operations, a confirmed, dated enforcement action. NAIH also fined Mediaworks Hungary Zrt. HUF 50 million (approximately EUR 125,000) for intentional and unlawful processing of personal and special-category data, reported with Probable confidence as the exact decision date has not been retrieved. NAIH's standard GDPR enforcement powers remain unchanged: fines of up to EUR 20 million or 4 percent of global annual turnover, whichever is greater, alongside warnings, reprimands and processing-ban orders. Alongside this established GDPR track, the AI Act's institutional framework under Act LXXV of 2025 and Decree 344/2025 introduces a new, parallel administrative-fine mechanism specific to AI Act breaches, converting the AI Act's EU-level fine categories into HUF ceilings. The specific HUF figures for this new mechanism have not been retrieved this cycle, so its practical severity relative to NAIH's GDPR fine powers cannot yet be compared directly. This is reported with Probable confidence pending confirmation of the decree's specific fine schedule. #### Outlook Confirmation of the HUF fine ceilings under Decree 344/2025 would allow a direct comparison between Hungary's AI Act administrative-fine exposure and its established GDPR fine exposure, sharpening the overall enforcement-risk picture for organisations deploying AI systems that also process personal data. NAIH's continuing GDPR enforcement activity, evidenced by the Obuda University and Mediaworks actions this cycle, indicates no slowdown in the established enforcement track notwithstanding the new parallel AI Act mechanism. Periodic update · new data 2026-10-11 #### Enforcement & Redress NAIH's confirmed enforcement record for 2026 includes two dated decisions predating the most recent research window. On 30 January 2026, NAIH fined the Hungarian University of Agriculture and Life Sciences EUR 4,200 for insufficient legal basis under GDPR Articles 5(1)(a) (lawfulness, fairness and transparency), 5(1)(c) (data minimisation), 6(1) (lawfulness of processing) and 13(1)-(2) (information to be provided to data subjects). A separate decision in May 2026 imposed a EUR 5,000 fine on an employer specifically for a data-minimisation failure. Both decisions sit within NAIH's general fining power under GDPR Article 83's two-tier structure, which permits fines up to EUR 20 million or 4% of global annual turnover for the higher tier, though neither of these two fines approaches that ceiling. A further, unconfirmed signal comes from a third-party aggregator reporting three cookie/tracker-related fines totalling HUF 27,000,000 attributed to 2026, which would add to NAIH's confirmed enforcement total for the year if corroborated against NAIH's own decision database. Taken together, the confirmed January and May decisions and the reported cookie-fine tally indicate a continuing, if modest, enforcement programme spanning institutional, employment, and commercial-privacy contexts rather than concentration in any single sector. #### Outlook The item to track is whether any decision within NAIH's enforcement record, confirmed or reported, falls specifically within the ongoing research window, and whether the aggregator-reported cookie-fine tally can be corroborated against NAIH's own published decisions. Continuing enforcement activity across varied processing contexts suggests NAIH's posture remains consistently active rather than episodic. Periodic update · new data 2026-09-21 #### Enforcement & Redress NAIH's enforcement posture intensified materially this cycle. The authority fined Mediaworks Hungary Zrt HUF 50 million (approximately EUR 125,000) for intentional unlawful processing of personal and special-category political-opinion data, linked from Mediaworks' news portals to an unauthorised interactive map of political sympathisers, in breach of GDPR Articles 6(1) and 9(1). This is a High-confidence finding, though the exact NAIH decision reference and date were not located this cycle, a gap this brief flags rather than resolves by inference. The special-category nature of the data involved and the unauthorised interactive-map delivery mechanism together distinguish this case from routine security-incident enforcement. Alongside the Mediaworks fine, NAIH recorded a substantial general enforcement-activity volume this cycle: 539 CCTV-related investigative proceedings, 133 formal applications, and 15 ex-officio enforcement actions, plus ex-officio inspections of 21 webshops that found recurring privacy-notice deficiencies. This is an Assessed-to-High-confidence composite finding sourced to a CMS GDPR Enforcement Tracker report, and it indicates NAIH sustained a high investigative tempo across CCTV and e-commerce sectors during the period, independent of the Mediaworks case specifically. #### Outlook The clearest open item is confirmation of the exact NAIH decision reference and date for the Mediaworks fine, which would allow future coverage to anchor to a primary regulatory source. A second item is whether the CCTV and webshop enforcement-volume figures represent a sustained elevated tempo or a single high-activity period, a question this brief cannot resolve without a prior-cycle baseline for comparison. D10 · Enforcement & Redress — Full Module Record 6 sub-modules · 78 words · 14 traced claims · Re-verified 2026-11-04 The decision headline, regulatory posture (Amber), primary framework, and supervisory authority above are open on the Free Explore layer. Register free with a business email for 3 full-record passes a month , or unlock all 170 jurisdictions with Single-Monitor or Portfolio Pro (1 seat) or Firm (up to 8 seats + client-advisory rights) . [Unlock with Free Pass / Sign In](https://a-i.gi/auth/login)[Partner & early-access terms →](https://a-i.gi/licensing/#enquiries)[View Open Exemplar (Gibraltar)](/jurisdictions/gi/) ## GDPR article map Cross-reference: which category/sub-module covers each UK GDPR article (38 mapped). Show article map GDPR article to category mapping Article Category Sub-module Art. 5 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 6 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) lawful bases Art. 7 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) consent thresholds Art. 9 [Lawful Processing & Special Data](#sec-cat-lawful_processing_and_special_data) special categories Art. 13 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 14 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 15 [Data Subject Rights](#sec-cat-data_subject_rights) access right Art. 16 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 17 [Data Subject Rights](#sec-cat-data_subject_rights) rectification and erasure Art. 18 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 19 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 20 [Data Subject Rights](#sec-cat-data_subject_rights) data portability Art. 21 [Data Subject Rights](#sec-cat-data_subject_rights) restriction and objection Art. 22 [Algorithmic, Biometric & Surveillance Governance](#sec-cat-algorithmic_biometric_and_surveillance_governance) automated decision making transparency Art. 25 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 28 [Controller/Processor Duties](#sec-cat-controller_processor_duties) joint controller arrangements Art. 30 [Controller/Processor Duties](#sec-cat-controller_processor_duties) ropa requirements Art. 32 [Controller/Processor Duties](#sec-cat-controller_processor_duties) security measures Art. 33 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 34 [Controller/Processor Duties](#sec-cat-controller_processor_duties) breach notification Art. 35 [Controller/Processor Duties](#sec-cat-controller_processor_duties) accountability and dpia Art. 37 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 38 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 39 [Controller/Processor Duties](#sec-cat-controller_processor_duties) dpo requirements Art. 44 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 45 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) adequacy received Art. 46 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 47 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) sccs and bcrs Art. 48 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 49 [Cross-Border & Adequacy](#sec-cat-cross_border_and_adequacy) transfer mechanisms Art. 77 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 78 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 79 [Enforcement & Redress](#sec-cat-enforcement_and_redress) private right of action Art. 80 [Enforcement & Redress](#sec-cat-enforcement_and_redress) collective redress and class actions Art. 81 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 82 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 83 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties Art. 84 [Enforcement & Redress](#sec-cat-enforcement_and_redress) regulator powers and penalties