HungaryNAIH Enforcement, GDPR Article 82, and Infotörvény Section 24 Sérelemdíj
Regulation (EU) 2016/679, Art. 82; 2011. evi CXII. torveny, 24. section
In force since .
An enforcement supervision rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, User location, Place of effect
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of (recorded ).
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
Buntetes Torvenykonyv (Btk., 2012. evi C. torveny) Section 219, Szemelyes adattal visszaeles (Misuse of personal data): unlawfully or purpose-divergently processing personal data, or failing to implement a data-security measure, in breach of the statutory or EU-law rules on personal-data protection, for the purpose of financial gain or causing significant harm to interests, is a misdemeanour punishable by imprisonment of up to 1 year (Section 219(1)); the same conduct as to failing to inform a data subject of their access rights while significantly harming interests is punished the same way (Section 219(2)); the offence is punishable by imprisonment of up to 2 years where it involves special-category or criminal personal data (Section 219(3)); and by imprisonment of up to 3 years, as a felony, where committed by an official person, using a public mandate, or with an unlawfully made image or audio recording of a court proceeding (Section 219(4)).
Penalty structure
Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4 percent of total worldwide annual turnover of the preceding financial year, whichever is higher, for the gravest infringement categories. Article 83(4) sets a lower tier, up to EUR 10,000,000 or 2 percent, for other listed provisions. Infotorveny Section 61(4), read in full from the Act's own text, sets a Hungary-specific fine cap of HUF 100,000 to HUF 20,000,000 that displaces the GDPR figure in two situations: a fine NAIH imposes for processing under Infotorveny Section 2(3) (law enforcement, national security, and national defense processing, which is outside GDPR's own scope), and, separately, any fine NAIH imposes under GDPR Article 83 itself where the fined entity is a koltsegvetesi szerv (a body financed from the state budget).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH), Hungary's independent supervisory authority, an autonomous state administrative body under the Infotorveny Section 38.
Enforcement record
NAIH's own 2025 annual report to Parliament ('NAIH beszamolo a 2025. evi tevekenysegrol', published ): the Authority imposed HUF 98,235,000 in fines during 2025, of which HUF 67,195,000 was data-protection fines (adatvedelmi birsag) specifically, HUF 27,965,000 procedural fines, and HUF 3,075,000 execution fines; the report also states the Authority's fine-account annual turnover was HUF 70.9 million, and that fines are paid into the central budget, not retained by the Authority. The report's own I.1 statistics table counts new 2025 data-protection authority proceedings (adatvedelmi hatosagi eljaras): 929 opened on complaint (kerelemre indult) plus 76 opened by the Authority on its own initiative (hivatalbol indult), 1,005 total, excluding the 11 and 12 respectively carried over from prior years. The report gives no separate count of how many of these proceedings concluded with a fine.
- As of
- Currency
- HUF
- Source link
- https://www.naih.hu/eves-beszamolok?download=1431:naih-beszamolo-a-2025-evi-tevekenysegrol
- Fines per year
- 67,195,000
- Actions per year
- 1,005
Settledness
- As of
- Case link
- https://curia.europa.eu/juris/document/document.jsf?docid=273284&doclang=EN
- Case citation
- Case C-300/21 UI v Österreichische Post AG, judgment of the Court of Justice (Third Chamber) of
- Open questions
- May a person whose personality right was infringed by the processing claim sérelemdíj under Section 24(2) of the Infotv. in addition to compensation under Article 82 of the GDPR for the same infringement?
What it makes you log
Logging duty
Section 24 and GDPR Article 82 set liability and compensation. Section 24(3) and (4) let a controller or processor escape liability by proving an unavoidable external cause or compliance with its duties, which is a defence and not a record duty. Section 23(2), which puts the burden of proving lawful processing on the controller or processor in a court action, is not cited by this row; the record duties sit in GDPR Articles 30 and 33(5) and Infotv. Sections 25/E, 25/F and 25/J.
- Kind
- None
- As of
What this law does
Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH), the National Authority for Data Protection and Freedom of Information, is Hungary's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 fines.
Section 24(2) of the Infotorveny is a Hungarian civil-law remedy that predates and now sits alongside GDPR Article 82: a person whose personality right has been infringed may claim serelemdij (compensation for infringement of a personality right) from the controller or processor, and Section 24(5) makes joint controllers and their processors jointly and severally liable for both ordinary damages and serelemdij.
Section 24 has been in force since , six years before GDPR Article 82 applied on . Under Section 24(3) a controller is released from liability for damage and serelemdij if it proves that an unavoidable cause outside the scope of the processing caused the harm, and under Section 24(4) a processor is released if it proves it complied with the obligations the law places on processors and with the controller's lawful instructions.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .