Hungary

Layer 1 is Regulation (EU) 2016/679 (the General Data Protection Regulation, or GDPR), Articles 3 and 27. Layer 2 is Hungary's own Act CXII of 2011 on informational self-determination and freedom of information (the 'Info Act', Infotv.). Section 2 of the Info Act splits the field: for processing inside the scope of the GDPR it applies only a named list of supplementary provisions, and for processing outside GDPR scope — law enforcement, national security, defence — Chapters III to V of the Info Act apply on their own terms, including its own third-country transfer rules in sections 10 and 11. The Info Act also carries Hungary's freedom-of-information regime, which reaches bodies performing public duties, state-owned companies and, in practice, their contractors. On 14 August 2026 the regulator announced an expansion of the entities and data categories covered by the Central Information Public Data Registry, so this exposure is widening, not narrowing.

The repeal chain matters because many trackers still list Hungary as a localisation country. Act CLVII of 2010 required that processing of state registers in the 'national data asset' happen only on Hungarian territory; it was repealed on 26 July 2021. Its successor, Act XCI of 2021 on the national data asset, repeated the rule in section 13 — 'A 12. § (3) bekezdese szerint meghatarozott nyilvantartasokhoz kapcsolodo adatfeldolgozasi muveletet az adatfeldolgozo kizarolag Magyarorszag teruleten vegezhet' — and was itself repealed with effect from 1 April 2024 by Act CI of 2023. Act CI of 2023, on the system for utilising the national data asset, contains no equivalent territorial restriction; it builds an opening-up framework around a National Data Asset Agency, the National Data Platform and a public data portal, and expressly contemplates foreign data intermediaries. Sector by sector: BANKING, PAYMENTS, INSURANCE AND SECURITIES — no localisation. The central bank's Recommendation 2/2025 on community and public cloud services says institutions must act with 'kulonos gondossaggal' (particular diligence) for cloud outside the European Economic Area because of data-protection and geopolitical risk, and must document that they considered third-country processing rules; that is a diligence duty, not a wall. HEALTH — no territorial rule found in the Health Data Act or the EESZT rules as at 18 August 2026; the national health data space is state-operated and physically in Hungary, but that is an operating fact, not a prohibition on private controllers. TELECOM — no storage-location rule found; the electronic communications regime is about retention and lawful access, not residency. GOVERNMENT — no residency rule found in current law, but the cybersecurity classification gate below bites hardest here. GEOSPATIAL — Act XLVI of 2012 requires state basic mapping data and aerial and satellite imagery to be held in national archives, which is a custody rule for the state's own copies rather than an export ban. GAMING — a genuine wall, see the rule entry. DEFENCE — not researched in depth; defence mapping databases sit with the defence ministry.

Layer 1 is Chapter V of the GDPR, and everything in the shared European brief applies unchanged: the 2021 Standard Contractual Clauses are the operative set, Binding Corporate Rules remain available, the Schrems II transfer impact assessment is still expected, and the EU-US Data Privacy Framework remains valid on 18 August 2026 while under active pressure. The adequacy list is the Commission's, not Hungary's. Layer 2 for non-GDPR processing is Info Act sections 10 and 11: a transfer to a third country needs the person's explicit consent, or necessity plus adequate safeguards, and section 10(4) treats protection as adequate where an EU legal act says so, where an international treaty guarantees the rights, or where the controller has examined the circumstances and concluded there are 'megfelelo garanciak' (adequate guarantees). Section 11 allows a narrow set of transfers without consent — vital interests, a threat to public security, or an individual case where no disproportionate restriction of rights results. There is no Hungarian registration or notification step for ordinary commercial transfers.

NAIH is a single national authority; Hungary has no regional data protection regulators. Evidence of live operation, all from the authority's own site and checked on 18 August 2026: a decisions register running to 29 May 2026; the 2025 annual report published 30 March 2026; a 7 July 2026 statement on the political use of children's personal data on social media; a 14 August 2026 announcement expanding the Central Information Public Data Registry. Decision NAIH-7395-6/2025 of 8 April 2025 fined a processor 2,000,000 forint (about $6,000) for failing to check firewall settings while migrating a roughly 900,000-record customer database, after which an attacker reached personal data including bank account numbers. That is the shape of Hungarian enforcement: regular, technically competent, and modest in money. Other regulators that matter here and are all operating: the Regulated Activities Supervisory Authority (SZTFH) as national cybersecurity authority; the National Cyber Security Institute (NKI) as incident response centre; the Magyar Nemzeti Bank for financial institutions; the Szerencsejatek Felugyelet for gambling; the National Media and Infocommunications Authority (NMHH) for electronic communications.

FLOOR. Act C of 2000 on accounting, section 169, sets an eight-year minimum for the annual report, the inventory, the general ledger and the supporting vouchers. Tax records are pinned to the limitation period under the tax procedure rules. Act XLVII of 1997 on health data (Euak.) sets very long minimums for health documentation, with discharge summaries kept longer than ordinary records; we could not retrieve the exact section text on 18 August 2026 because the official database truncates long statutes, so treat the specific year counts as medium confidence. Act LXIX of 2024 requires organisations in scope to hold a cybersecurity audit cycle, with the first audit due by 30 June 2026, which creates its own evidence-retention expectation. CEILING. GDPR Article 5(1)(e) storage limitation plus the Article 17 erasure right. CONFLICT. The GDPR itself resolves it: Article 17(3)(b) disapplies erasure where processing is needed to comply with a legal obligation under member state law, so the Hungarian keep-periods override the delete request for the documents they cover — but only for those documents, not for the marketing database that happens to sit next to them.

CLOCK 1 — GDPR Article 33: notify NAIH without undue delay and where feasible within 72 hours of becoming aware; Article 34 adds notice to the affected individuals where the risk is high. CLOCK 2 — Act LXIX of 2024 on the cybersecurity of Hungary. Sections 6(5)(e), 18(1) and 19(2) require in-scope organisations and central system operators to report cyber threats and incidents to the competent cybersecurity incident handling centre, which is the National Cyber Security Institute. We could not retrieve the numeric deadlines from the official consolidated text on 18 August 2026 because the database truncates the statute; the underlying Directive (EU) 2022/2555 requires an early warning within 24 hours, a fuller notification within 72 hours and a final report within one month, and Hungary transposed that directive, so plan to those figures and verify before relying on them. CLOCK 3 — Regulation (EU) 2022/2554 (DORA) has applied to financial entities since 17 January 2025 and runs its own major-ICT-incident timetable. The common failure is treating a ransomware event as a single report: in Hungary it is simultaneously a personal data breach for NAIH, a cyber incident for the incident response centre, and, for a bank, an ICT incident for the supervisor.

(1) CRIMINAL LIABILITY. Section 219 of Act C of 2012, the Criminal Code, punishes processing personal data without authorisation or for a purpose other than the stated one, or failing to take data security measures, where done for gain or causing significant harm: up to one year of imprisonment, up to two years where special-category data is involved, and up to three years, as a felony, where committed by a person acting in an official capacity. This is a personal exposure for named individuals, which changes how Hungarian managers behave in an incident. (2) THE DEAD LOCALISATION RULE. Act CLVII of 2010 and then Act XCI of 2021 required national-data-asset registers to be processed only on Hungarian territory. Both are repealed; the second stopped applying on 1 April 2024. Advisers still citing it are wrong, and advisers relying on that repeal without reading Act LXIX of 2024 are also wrong. (3) EXPIRED CLOCKS. Under the cybersecurity regime an organisation must register within 30 days of coming into scope, survey its systems within 90 days, complete classification within 120 days and file a security policy within 180 days; organisations already operating before 1 January 2025 had to contract an auditor by 31 August 2025 and complete a first audit by 30 June 2026. (4) GAMBLING. Beyond the European Economic Area server rule, access must be restricted to players connecting from Hungarian IP addresses and the authority must have continuous remote access to the server. (5) TRANSPARENCY. The Info Act's public-data regime reaches bodies performing public duties and state-owned companies, and the regulator announced on 14 August 2026 that the Central Information Public Data Registry is being widened. (6) SOVEREIGNTY LAW. Act LXXXVIII of 2023 created a Sovereignty Protection Office with broad powers to demand information; on 12 February 2026 Advocate General Kokott advised the Court of Justice that the law breaches EU law, including data protection rules, but the judgment is not out and the powers remain on the books.

DATED. (a) Case C-829/24, Commission v Hungary, on Act LXXXVIII of 2023 on the protection of national sovereignty: Advocate General Kokott's Opinion of 12 February 2026 found the Sovereignty Protection Office's investigative and disclosure powers incompatible with EU law, including data protection rules; judgment pending as at 18 August 2026. (b) 12 January 2027: the Data Act's zero data-egress-fee obligation, from the shared European layer. (c) Cybersecurity audits were due by 30 June 2026, so supervisory action and fees are the next phase. (d) Act CI of 2023 on utilising the national data asset has staged commencement, with further provisions applying from 1 January 2026; the exact staging could not be pinned down and is listed as unconfirmed. DORMANT SWITCHES, which matter more. (1) Hungary has twice legislated a Hungary-only processing rule for state registers and twice repealed it; a single ordinary statute could bring it back, and the drafting precedent already exists. (2) Under the cybersecurity law the classification framework is the lever: tightening the classification rules would tighten foreign processing across energy, transport, banking, health, water, digital infrastructure and public administration without touching the privacy law at all. (3) The gambling authority's licensing conditions are set by ministerial and authority decree, not primary legislation, so the European Economic Area server rule can be narrowed to Hungary by decree. (4) The Sovereignty Protection Office's information-gathering powers remain exercisable until and unless the Court of Justice rules otherwise.