HungaryCybersecurity Act, Incident Notification and Cybersecurity Fine
2024. évi LXIX. törvény, 66. §; 418/2024. (XII. 23.) Korm. rendelet, 42. § és 77. §
In force since .
A vulnerability and incident reporting rule binding public and private bodies.
- Obligation class
- Reporting, Security
What it requires
- This duty reaches your service on the same basis as this jurisdiction's companion risk-management row: an essential or important organization under Section 1, including a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, whether or not you are established there.
- Notify the national cybersecurity incident-handling center (Nemzeti Kiberbiztonsági Intézet, the NKI) of a cyber threat, near-incident or cybersecurity incident affecting your electronic information system: an initial notification without undue delay and in any case within 24 hours of becoming aware, an event notification without undue delay and in any case within 72 hours of becoming aware that updates that report and assesses the incident's severity and impact, and a final report no later than one month after the event notification.NIST CSF 2.0RS.CO-02
- If you are a trust service provider, notify the center of a cybersecurity incident affecting your trust services without undue delay and in any case within 24 hours of becoming aware of it, in place of the event notification (Decree 418/2024, Section 77(4)).NIST CSF 2.0RS.CO-02
- Submit an interim status report if the center asks for one, and, if the incident is still ongoing when the final report is due, a report on the results achieved so far followed by a final report within one month after you have finished handling the incident (Decree 418/2024, Section 77(1)).NIST CSF 2.0RS.CO-03
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST CSF 2.0
- CIS Controls
- 17.2A maintained list of who to contact about a security incident, inside and outside the enterprise.
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Criminal exposure note
Section 42 of Government Decree 418/2024 (XII. 23.) makes the sanction for a Section 66 notification failure an administrative cybersecurity fine; neither the Act nor the Decree creates a criminal offence for the failure, though Section 44(4) of the Decree states that paying the fine does not exempt the organization from any separate criminal or civil liability that applies.
Penalty structure
Government Decree 418/2024 (XII. 23.) Section 42(2) sets the same ceiling for a Section 66 notification failure as for a Section 6 risk-management failure: the forint equivalent of EUR 10,000,000 or, if higher, 2 percent of worldwide turnover for an essential organization, mirroring NIS2 Article 34(4); EUR 7,000,000 or 1.4 percent for an important organization, mirroring Article 34(5). Section 42(4) separately lets the national cybersecurity authority fine the head of an organization personally up to HUF 15,000,000 for failing to meet a statutory duty.
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 10,000,000
- Turnover percentage cap
- 2
Who enforces it
Enforcement body
The Szabályozott Tevékenységek Felügyeleti Hatósága (SZTFH, the Supervisory Authority of Regulated Activities) for an organization under Section 1(1)(d) or (e) of the Act; a separate national cybersecurity authority the Government designates by decree enforces instead against a public-administration, state-influenced or critical-infrastructure organization under Section 1(1)(a), (b), (c) or (f). Notifications themselves are received by the national cybersecurity incident-handling centre regardless of which authority later enforces.
Settledness
- As of
What this law does
Section 66(2) of the Act requires an organization under Section 1(1)(d) or (e) to notify the national cybersecurity incident-handling centre of a threat, near-incident or cybersecurity incident causing serious disruption or damage, as specified in a government decree. Section 66(1) imposes the equivalent duty, without that materiality filter, on a public-administration, state-influenced or critical-infrastructure organization under Section 1(1)(a) to (c) or (f).
Section 77(1) of Government Decree 418/2024 sets the clock those notifications run on. It requires an initial notification without undue delay and in any case within 24 hours of becoming aware of the incident. It requires an event notification within 72 hours that updates the initial report and assesses the incident's severity and impact.
It requires a final report no later than one month after that 72-hour event notification, or, if the incident is still ongoing at that point, a report on progress so far followed by a final report within one month of its resolution. Section 42 of the same Decree makes an infringement of either Section 66 or the Decree's own notification rules punishable by an administrative cybersecurity fine on the same NIS2-mirroring tiers as the risk-management duty.
When LexLint raises it
When your app profile says your app runs an essential service or operates a social platform.
Back to the example · Lint your app
Page updated .