Processes personal data, in Hungary

2001. évi CVIII. törvény az elektronikus kereskedelmi szolgáltatások, valamint az információs társadalommal összefüggő szolgáltatások egyes kérdéseiről (Ekertv.), 13/A. § · Read the law's page

• Process a service recipient's personal data only for the contract and billing purposes in Section 13/A paragraphs 1 and 2 or because the data are technically indispensable to providing the service (Electronic Commerce Act Section 13/A, paragraph 3).
• Use data about the use of the service for any other purpose, such as targeted advertising or market research, only after defining the purpose in advance and obtaining the recipient's consent (Section 13/A, paragraph 4).
• Let the recipient prohibit that other processing before and during use of the service, and do not link the data to the recipient's identifying data or pass them to a third party without the recipient's consent (Section 13/A, paragraphs 5 and 6).
• Delete data processed for the contract, billing and technical purposes after the contract ends or is not concluded and after billing, and delete data processed for the other purpose once that purpose ends or the recipient so decides (Section 13/A, paragraph 7).
• Do not make a service that is not available from another provider conditional on consent to processing for other purposes (Section 13/A, paragraph 8).
• Let the recipient learn, before and during use of the service, which kinds of data you process for which purposes (Section 13/A, paragraph 9).

2011. evi CXII. torveny az informacios onrendelkezesi jogrol es az informacioszabadsagrol · Read the law's page

• Establish a GDPR Article 6 lawful basis before processing personal data of a person in Hungary; the Infotorveny supplements the GDPR with mainly procedural rules rather than a substantive addition to that basis.

Regulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section · Read the law's page

• Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.

Regulation (EU) 2016/679, Arts. 12-21; 2011. évi CXII. törvény (Infotv.), §§ 23, 25 · Read the law's page

• Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Hungary within one month of receipt.
• For five years after a person in Hungary dies, honor a request to access, rectify, erase, restrict or object to processing of their personal data from someone the deceased authorised, or, failing that, from a close relative, under Information Act (Infotv.) Section 25.

Regulation (EU) 2016/679, Arts. 33-34; 2011. evi CXII. torveny, 25/J-25/K. section, as inserted by 2018. evi XXXVIII. torveny 17. section · Read the law's page

• Notify NAIH without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Hungary, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
• If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
• If you are a controller processing personal data in Hungary for law-enforcement, national-security or defence purposes, record the breach data Section 25/J(5) lists and report the breach to NAIH without delay, no later than 72 hours after you become aware of it, unless it is likely that the breach poses no risk to the exercise of the data subjects' rights, under Information Act (Infotv.) Section 25/J(1) and (2).

Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page

• Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Hungary outside the EEA.

2012. évi I. törvény a munka törvénykönyvéről (Mt.), 11/A. § · Read the law's page

• If you monitor an employee's conduct in connection with the employment by a technical means, inform the employee of it in writing in advance (Labour Code Section 11/A, paragraph 1).
• Check only employment-related data stored on the device the employee uses for the employment, which includes the data needed to verify that a device you provided is used only for the employment unless otherwise agreed (Section 11/A, paragraphs 2 to 4).
• Apply the same limit to an employee's own device that the employee uses for the employment by agreement (Section 11/A, paragraph 5).

2025. évi XCII. törvény a magánjogi tárgyú törvények módosításáról · Read the law's page

• These rules are enacted but do not apply yet: they apply to products placed on the market or put into service after 9 December 2026, and sections 6:550 to 6:559 of the Civil Code now in force keep governing earlier products (Sec. 95(6) of Act XCII of 2025; Sec. 55/A of Act CLXXVII of 2013).
• If you develop, make or have made a product, software included, or present yourself as its manufacturer by your name, trade mark or other distinguishing sign, you answer for damage a defect in it causes (Secs. 6:550(1)(a), 6:552 and 6:554(2)(a)).
• Keep supplying the software updates and upgrades needed to keep the product safe while it is within your control: a defect that arises after you put the product into circulation because of software, an update or upgrade, or a missing update needed to maintain safety is not excused (Sec. 6:557(5)).
• Treat safety-relevant cybersecurity requirements and any recall as part of what decides whether your product is defective (Sec. 6:555(2)(f) and (g)).
• Allow for what the product learns or acquires after it is placed on the market, because the effect of that ability is weighed in deciding whether it is defective (Sec. 6:555(2)(c)).
• Keep evidence you could produce if a court orders you to make it available: failing to do so presumes the product defective (Sec. 6:556(1)(a)).
• If you are outside the EU, the importer, your authorized representative or, failing them, the fulfilment service provider answers for the product in your place (Sec. 6:550(1)(c)).
• If you distribute a product or run an online platform that lets consumers contract with traders, identify the liable business established in the EU, or your own supplier, within one month of the injured person's request, or you answer for the damage (Sec. 6:550(5) and (6)).
• If you substantially modify a product outside the manufacturer's control and then distribute it or put it into service, you answer as its manufacturer (Sec. 6:550(4)).
• If you build a software component into a product, you have no recourse against a micro or small enterprise that made the software where you waived recourse in the contract (Sec. 6:551).
• Do not rely on a contract term to limit or exclude liability to the injured person, because it is void (Sec. 6:559).
• Free and open-source software developed or made available in the course of a non-commercial activity is outside the chapter (Sec. 6:559/B(2)(b)).