Hungary

The first layer is Regulation (EU) 2016/679, the General Data Protection Regulation. The second layer is Hungary's own Act CXII of 2011 on informational self-determination and freedom of information, known as the Info Act or Infotv. The Info Act splits the field in two. For work covered by the General Data Protection Regulation, it adds only a named list of extra rules. For work outside that Regulation, it applies on its own terms. That means law enforcement, national security and defence, including the Info Act's own rules on sending data to countries outside Europe. The Info Act also carries Hungary's freedom-of-information rules. Those reach bodies performing public duties, state-owned companies and, in most cases, their contractors. On 14 August 2026 the regulator announced it was widening the bodies and data types covered by the Central Information Public Data Registry. So this exposure is growing, not shrinking.

The chain of repeals matters, because many trackers still list Hungary as a country where data must stay put. Act CLVII of 2010 said state registers in the 'national data asset' could only be handled on Hungarian territory. It was repealed on 26 July 2021. Its successor, Act XCI of 2021 on the national data asset, repeated the rule: 'A 12. § (3) bekezdese szerint meghatarozott nyilvantartasokhoz kapcsolodo adatfeldolgozasi muveletet az adatfeldolgozo kizarolag Magyarorszag teruleten vegezhet'. That Act was itself repealed with effect from 1 April 2024 by Act CI of 2023. Act CI of 2023, on using the national data asset, has no equivalent location restriction. It builds an opening-up structure around a National Data Asset Agency, the National Data Platform and a public data portal. It expressly allows for foreign data intermediaries. Industry by industry. BANKING, PAYMENTS, INSURANCE AND SECURITIES: no rule that data must stay in Hungary. The central bank's Recommendation 2/2025 covers community and public cloud services. It says firms must act with 'kulonos gondossaggal', meaning particular care, for cloud outside the European Economic Area. The reason is data protection and geopolitical risk. Firms must also record that they considered the rules of the destination country. That is a duty to take care, not a ban. HEALTH: we found no location rule in the Health Data Act or the EESZT rules as at 18 August 2026. The national health data space is run by the state and sits physically in Hungary. That is how it happens to work, not a ban on private companies. TELECOM: we found no storage-location rule. The electronic communications rules are about keeping data and lawful access, not about where data sits. GOVERNMENT: we found no location rule in current law. The cybersecurity classification step below hits hardest here. GEOSPATIAL: Act XLVI of 2012 requires state basic mapping data and aerial and satellite imagery to be held in national archives. That is a custody rule for the state's own copies, not a ban on export. GAMING: a real restriction, see the rule entry. DEFENCE: not researched in depth. Defence mapping databases sit with the defence ministry.

The first layer is Chapter V of the General Data Protection Regulation. Everything in the shared European brief applies unchanged. The 2021 standard contract clauses are the current set. Company-wide binding rules remain available. You are still expected to write down why the destination country is safe, following the Schrems II judgment. The EU-US Data Privacy Framework is still valid on 18 August 2026, though it is under active pressure. The list of approved countries is the European Commission's, not Hungary's. The second layer covers work outside that Regulation, and comes from the Info Act. Sending data to a country outside Europe needs the person's explicit consent. Or it must be necessary and come with adequate safeguards. Protection counts as adequate in three cases. A European Union legal act says so. Or an international treaty guarantees the rights. Or the company has examined the circumstances and concluded there are 'megfelelo garanciak', meaning adequate guarantees. A narrow set of transfers is allowed without consent. Those are vital interests, a threat to public security, or a single case where no rights are restricted out of proportion. There is no Hungarian registration or notification step for ordinary business transfers.

NAIH is a single national authority. Hungary has no regional privacy regulators. Here is the evidence that it is working, all from the authority's own site and checked on 18 August 2026. Its decisions register runs to 29 May 2026. Its 2025 annual report was published on 30 March 2026. It issued a 7 July 2026 statement on the political use of children's personal data on social media. On 14 August 2026 it announced it was widening the Central Information Public Data Registry. Decision NAIH-7395-6/2025 of 8 April 2025 fined a supplier 2,000,000 forint (about 6,000 US dollars). The supplier had failed to check firewall settings while moving a customer database of roughly 900,000 records. An attacker then reached personal data including bank account numbers. That is what Hungarian enforcement looks like: regular, technically competent, and modest in money. Other regulators that matter here are all working. The Regulated Activities Supervisory Authority (SZTFH) is the national cybersecurity authority. The National Cyber Security Institute (NKI) is the incident response centre. The Magyar Nemzeti Bank covers financial firms. The Szerencsejatek Felugyelet covers gambling. The National Media and Infocommunications Authority (NMHH) covers electronic communications.

MINIMUMS. Act C of 2000 on accounting sets an eight-year minimum for the annual report, the inventory, the general ledger and the supporting receipts. Tax records are tied to the time limit in the tax procedure rules. Act XLVII of 1997 on health data, known as Euak., sets very long minimums for health records. Discharge summaries are kept longer than ordinary records. We could not retrieve the exact text on 18 August 2026, because the official database cuts off long laws. So treat the specific year counts as medium confidence. Act LXIX of 2024 makes covered organisations run a cybersecurity audit cycle. The first audit was due by 30 June 2026. That creates its own need to keep evidence. MAXIMUM. The General Data Protection Regulation says do not keep personal data longer than you need it. It also gives people the right to have data erased. CONFLICT. The Regulation settles this itself. The right to erasure does not apply where you need the data to meet a legal duty under national law. So the Hungarian keeping periods beat the deletion request for the documents they cover. Only those documents. Not the marketing database that happens to sit next to them.

CLOCK 1. Under the General Data Protection Regulation, tell NAIH without undue delay and, where you can, within 72 hours of finding out. You must also tell the people affected where the risk to them is high. CLOCK 2. Act LXIX of 2024 on the cybersecurity of Hungary. Covered organisations and central system operators must report cyber threats and incidents to the relevant cybersecurity incident handling centre. That is the National Cyber Security Institute. We could not get the deadlines in hours from the official consolidated text on 18 August 2026, because the database cuts off the law. Hungary copied Directive (EU) 2022/2555 into national law. That directive requires an early warning within 24 hours, a fuller notice within 72 hours and a final report within one month. Plan to those figures, and check them before you rely on them. CLOCK 3. Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied to financial firms since 17 January 2025. It runs its own timetable for major technology incidents. The common mistake is treating a ransomware attack as one report. In Hungary it is three at once. It is a personal data breach for NAIH. It is a cyber incident for the incident response centre. And for a bank it is a technology incident for the supervisor.

(1) CRIMINAL LIABILITY. Act C of 2012, the Criminal Code, punishes three things. Using personal data without authority. Using it for a purpose other than the stated one. And skipping data security measures. This applies where it was done for gain or caused significant harm. The penalty is up to one year in prison. It is up to two years where special-category data is involved. It is up to three years, as a felony, where a person acting in an official capacity did it. This exposes named individuals personally, which changes how Hungarian managers behave in an incident. (2) THE DEAD RULE ABOUT DATA STAYING IN HUNGARY. Act CLVII of 2010, and then Act XCI of 2021, required national-data-asset registers to be handled only on Hungarian territory. Both are repealed. The second stopped applying on 1 April 2024. Advisers still citing it are wrong. So are advisers who rely on that repeal without reading Act LXIX of 2024. (3) DEADLINES THAT HAVE ALREADY PASSED. Under the cybersecurity law you must register with the authority within 30 days of being covered. You must survey your systems within 90 days. You must finish classification within 120 days. You must file a security policy within 180 days. Organisations already running before 1 January 2025 had to hire an auditor by 31 August 2025 and finish a first audit by 30 June 2026. (4) GAMBLING. Beyond the European Economic Area server rule, access must be limited to players connecting from Hungarian internet addresses. The authority must have continuous remote access to the server. (5) TRANSPARENCY. The Info Act's public-data rules reach bodies performing public duties and state-owned companies. On 14 August 2026 the regulator announced that the Central Information Public Data Registry is being widened. (6) SOVEREIGNTY LAW. Act LXXXVIII of 2023 created a Sovereignty Protection Office with broad powers to demand information. On 12 February 2026 Advocate General Kokott advised the Court of Justice that the law breaks European Union law, including privacy rules. The judgment is not out, and the powers remain in force.

WITH DATES. (a) Case C-829/24, Commission v Hungary, on Act LXXXVIII of 2023 on the protection of national sovereignty. Advocate General Kokott's Opinion of 12 February 2026 found the Sovereignty Protection Office's investigation and disclosure powers incompatible with European Union law, including privacy rules. Judgment was still pending as at 18 August 2026. (b) 12 January 2027: the Data Act's rule that moving your data out of a cloud must cost nothing, from the shared European layer. (c) Cybersecurity audits were due by 30 June 2026, so supervision and fees come next. (d) Act CI of 2023 on using the national data asset starts in stages, with more parts applying from 1 January 2026. We could not pin down the exact staging, so it is listed as unconfirmed. POWERS ALREADY HELD, which matter more. (1) Hungary has twice passed a Hungary-only handling rule for state registers, and twice repealed it. One ordinary law could bring it back, and the drafting already exists. (2) Under the cybersecurity law, the classification rules are the lever. Tightening them would tighten foreign handling across energy, transport, banking, health, water, digital infrastructure and public administration. The privacy law would not need to change at all. (3) The gambling authority's licence conditions are set by ministerial and authority decree, not by an Act of Parliament. So the European Economic Area server rule could be narrowed to Hungary alone by decree. (4) The Sovereignty Protection Office can keep using its information-gathering powers unless and until the Court of Justice rules otherwise.