How are data and cybersecurity laws/regulations implemented?
Last review date: December 2024
- omnibus — all personal data
- sector-specific — e.g., financial institutions, governmental bodies
- constitutional
What are the key data privacy laws and regulations?
Last review date: December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide cybersecurity and other data-related legislation.
- EU General Data Protection Regulation
- Fundamental Law of Hungary (25 April 2011)
- Act No. CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (Information Act)
- Act XLVII of 1997 on Processing and Protection of Medical and Other Related Personal Data
- Act LIII of 2018 on the Protection of Privacy
- Act C of 2003 on Electronic Communications
- Act CI of 2023 on the System for the Exploitation of National Data Assets and on Certain Services
- Act XXV of 2023 on Complains and Public Interest Disclosures, and on the Rules of Whistleblowing Notifications
What are the key cybersecurity laws and regulations?
Last review date: December 2024
Please refer to the EU Chapter for detailed information regarding EU-wide cybersecurity and other data-related legislation.
- EU General Data Protection Regulation
- Directive (EU) 2022/2555 of the European Parliament and of the Council of 14 December 2022 on measures for a high common level of cybersecurity across the Union, amending Regulation (EU) No 910/2014 and Directive (EU) 2018/1972, and repealing Directive (EU) 2016/1148 (NIS 2 Directive)
- Regulation (EU) 2024/2847 of the European Parliament and of the Council of 23 October 2024 on horizontal cybersecurity requirements for products with digital elements and amending Regulations (EU) No 168/2013 and (EU) No 2019/1020 and Directive (EU) 2020/1828 (Cyber Resilience Act)
- Commission Implementing Regulation (EU) 2018/151
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information - Information Act
- Act CVIII of 2001 on Electronic Commercial Services and Certain Matters regarding Information Society Services
- Act C of 2003 on Electronic Communications
- Act CXXXVIII of 2007 on Investment Firms and Commodity Dealers, and on the Regulations Governing their Activities
- Act CXX of 2001 on the Capital Market
- Government Decree no 42 of 2015 (III. 12.) on the Protection of Information Technology Systems of Financial Institutions, Insurance and Reinsurance Undertakings, Investment Firms and Commodity Dealers
- SZTFH Decree 10/2023 (V. 15.) on the cybersecurity certification of the information and communication technologies
- SZTFH Decree no. 15 of 2023 (VII. 31.) on the Administrative Service Fees of the Procedures of the Supervisory Authority of Regulated Activities Regarding its Cybersecurity Tasks
- Regulation (EU) 2022/2554 on digital operational resilience for the financial sector
- MK Decree No. 7/2024 (VI. 24.) on the Requirements for Security Classification and the Specific Security Measures to be applied for Each Security Class
- SZTFH Decree No. 7/2024 (VI. 24.) on the Registry of Auditors Authorized to Conduct Cybersecurity Audits and the Requirements for Auditors
- SZTFH Decree no. 10 of 2024. (VIII. 8.) on the National Cybersecurity Certification Scheme for IoT Devices
- Act LXIX of 2024 on Hungary’s Cybersecurity (“Cybersecurity Act”)
- Government Decree No. 418/2024 (XII. 23.) on the Implementation of the Cybersecurity Act
What are the key laws and regulations relating to non-personal data?
Last review date: December 2024
- Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information - Information Act
- Act CVIII of 2001 on Electronic Commercial Services and Certain Matters regarding Information Society Services
- Government Decision 1507/2023 (XI. 22.) on the measures necessary for the application of Regulation (EU) 2022/868 of the European Parliament and of the Council on European data governance and amending Regulation (EU) 2018/1724
- Government Decree 250/2024 (VIII. 15.) on the Tasks of the National Agency for Data Assets and on Data Utilisation Support Services
- Act L of 2013 on the Electronic Information Security of the State and Local Municipality Organizations (effective until 31 December 2024)
- Act CI of 2023 on the System for the Exploitation of National Data Assets and on Certain Services
Are new or material changes to those key data and cybersecurity laws anticipated in the near future?
Last review date: December 2024
Yes. The Cybersecurity Act will repeal, as of 1 January 2025, the Cyber Certification Act and Act L of 2013 on the Electronic Information Security of State and Local Government Bodies and, together with its implementing government decree, Government Decree No. 418/2024 (XII. 23.) on the Implementation of the Cybersecurity Act, provide a new framework for Hungarian cybersecurity regulation.