HungaryGDPR Articles 33-34 and Infotörvény Sections 25/J-25/K, Breach Notification in Hungary
In force since .
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Notify NAIH without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Hungary, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
- If you are a controller processing personal data in Hungary for law-enforcement, national-security or defence purposes, record the breach data Section 25/J(5) lists and report the breach to NAIH without delay, no later than 72 hours after you become aware of it, unless it is likely that the breach poses no risk to the exercise of the data subjects' rights, under Information Act (Infotv.) Section 25/J(1) and (2).
These lines are LexLint's reading of the law's text. Also read by: Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.naih.hu/adatvedelmi-incidensek-infotv
- Guidance body
- Nemzeti Adatvédelmi és Információszabadság Hatóság (Hungarian National Authority for Data Protection and Freedom of Information)
What it makes you log
Who may demand the log
Regulator
Logging duty
The controller documents every personal data breach, whether or not it is notified. For processing for law-enforcement, national-security or defence purposes, Section 25/J(1) also has the controller record the nature of the breach, its likely consequences and the measures taken or planned, and report the breach to the Authority within 72 hours. The texts name no fixed log fields.
- Kind
- Explicit
- As of
- Provision
- Regulation (EU) 2016/679, Art. 33(5); Information Act (Infotv.), Section 25/J(1)
- Trigger
- security_incident
What this law does
A controller must notify NAIH without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.
Sections 25/J and 25/K of the Information Act set a parallel duty, with a 72-hour deadline, for controllers processing personal data for law-enforcement, national-security or defence purposes, which Section 2(3) places under the Act itself; they are not among the provisions Section 2(2) applies to processing the General Data Protection Regulation (GDPR) governs. Act XXXVIII of 2018, Section 17, inserted these sections.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .