Hungary

Act LXXV of 2025 builds Hungary's domestic institutional framework for the EU AI Act. Section 11(1) authorizes the Government to designate, by decree, the AI notifying authority and the AI market surveillance authority (done by Government Decree 344/2025 (X. 31.)); the Act itself does not name them.

A Hungarian Artificial Intelligence Council, drawing one delegate each from bodies including the National Media and Infocommunications Authority, the Hungarian National Bank, the Competition Authority, the data protection authority NAIH, the Regulated Activities Supervisory Authority, and the National Intellectual Property Office, advises on national AI strategy and reviews the AI regulatory sandbox.

Section 7(1) empowers the AI market surveillance authority to impose an administrative fine, declare an AI system's use unlawful, or order the offender to stop the unlawful conduct or restore a lawful state, with the fine's amount and procedure left to the same government decree. Section 10 has the AI market surveillance authority establish and operate the AI regulatory sandbox under Article 57 of Regulation (EU) 2024/1689.

Section 204 criminalizes acquiring, offering, producing, or distributing a pornographic image depicting a person under eighteen, with a definition, read verbatim, that reaches synthetic content without naming AI: paragraph (8) defines a pornographic image for this section to include the realistic depiction of a non-existent person or persons. A wholly AI-generated image with no real child behind it falls inside the offense on that text alone.

The current text of the 'Gyermekpornográfia' subtitle, Sections 204 and 204/A, was substituted whole by Section 20 of Act LXXIX of 2021. That Act's own Section 24(1) puts it into force on the 15th day after promulgation; the stored source for Section 204 itself does not carry that promulgation day.

Section 25/J(1), read verbatim from the Act's own footnoted text, confirms the General Data Protection Regulation (GDPR)-uniform 72-hour standard: a controller records specified data about a personal-data breach and reports it to NAIH without delay, but no later than 72 hours after becoming aware of it.

The Act's own footnotes show this subtitle was inserted by Act XXXVIII of 2018, Section 17, confirming on primary text the amending act commentary had previously dated only approximately (sectoral alignment completed by 26 April 2019). This restates rather than derogates from GDPR Articles 33-34; a separate commentary claim that controllers report through a dedicated Personal Data Breach Reporting System in the Hungarian language was not confirmed or contradicted by the text read.

Hungary's data-protection act predates the General Data Protection Regulation (GDPR) by roughly seven years and, unusually, originally combined data protection and freedom-of-information law in one statute; the freedom-of-information half was never split into a separate act and remains bundled alongside the data-protection half.

A direct crawler-based read of the Act's own Hungarian text supplies primary-sourced dates: footnote 1 states the Act was adopted by the National Assembly on 11 July 2011 and promulgated on 26 July 2011, and Section 73(1) reads that the Act enters into force the day after promulgation with exceptions in paragraphs (2) and (3); paragraph (2) puts most substantive sections, including the sections numbered 1 through 37, in force 1 January 2012, which is the date recorded here.

Rather than repeal the Infotorveny when the GDPR became directly applicable, Hungary amended it (sectoral alignment completed by 26 April 2019, per commentary) so it now operates as a supplementary, mainly procedural statute alongside the Regulation.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. CMS commentary states explicitly there are no derogations from the General Data Protection Regulation (GDPR) for cross-border transfer in Hungary.

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. No Hungary-specific derogation appears in commentary; the Infotorveny's text confirms its definitions and its Section 24 remedy, and no data-subject-rights derogation beyond what commentary reports has been located.

Nemzeti Adatvedelmi es Informacioszabadsag Hatosag (NAIH), the National Authority for Data Protection and Freedom of Information, is Hungary's supervisory authority, with General Data Protection Regulation (GDPR) Article 83 fines.

Section 24(2) of the Infotorveny, read verbatim, confirms a genuine Hungarian civil-law addition that predates and now sits alongside GDPR Article 82 (Section 24 itself is original, unamended 2011 Act text, in force since 1 January 2012, six years before GDPR Article 82's own 25 May 2018 application date): a person whose personality right has been infringed may claim serelemdij (compensation for infringement of a personality right) from the controller or processor, and Section 24(5) makes joint controllers and their processors jointly and severally liable for both ordinary damages and serelemdij.

Section 24(3)-(4) give a force-majeure-style exemption for an unavoidable cause outside the scope of the processing.

The Infotorveny's own definitions list biometric data alongside racial or ethnic origin, political opinion, religious belief, trade-union membership, genetic data, health data, and sex-life or orientation data as a special category, matching General Data Protection Regulation (GDPR) Article 9(1) exactly.

Its biometric definition, read verbatim from the Act's own text, is a near-verbatim restatement of GDPR Article 4(14): "biometrikus adat: egy termeszetes szemely fizikai, fiziologiai vagy viselkedesi jellemzoire vonatkozo olyan, sajatos technikai eljarasokkal nyert szemelyes adat, amely lehetove teszi vagy megerositi a termeszetes szemely egyedi azonositasat, mint peldaul az arckep vagy a daktiloszkopiai adat" (English: biometric data means personal data obtained through specific technical procedures relating to the physical, physiological, or behavioural characteristics of a natural person, which enables or confirms the unique identification of that natural person, such as the facial image or dactyloscopic fingerprint data), naming the same two examples GDPR names and no others, including no audio analogue.

A reported employment-biometric derogation, permitting biometric access control to prevent unauthorized access to classified or hazardous information, comes from one commentary source only (CMS) and could not be verified against this primary text; it is not asserted here.

Section 423(1) makes it a misdemeanour, punishable by up to two years' imprisonment, to log into an information system without authorization by violating or circumventing a technical access-control measure, or to stay logged in beyond one's authorization.

Section 423(2) makes it a felony, punishable by up to three years, to hinder an information system's functioning or to modify, delete, or render data inaccessible without authorization, with Section 423(3)-(4) raising the term to one to five years where a significant number of systems are affected or significant harm results, and to two to eight years where the target is a public-interest facility.

Section 424 separately criminalizes making, handing over, or acquiring a password or program built to facilitate one of these offenses. Section 423's current text derives from Act LXXII of 2014, Section 86, per the Hungarian-language consolidated text's own footnote apparatus, with no later repeal noted.

Section 35/A(1) makes it a free use to reproduce a work for the text-and-data mining it requires, provided the user has lawful access to the work, the rightsholder has not objected to the free use in advance and in an appropriate manner (for content made available online, in a machine-readable form), and any copies made for the mining are kept only as long as the mining itself needs them.

Section 35/A(2) gives research organizations and cultural heritage institutions a separate, non-waivable exception for text-and-data mining carried out for scientific research, without the opt-out that limits the general exception. The section was inserted by Act XXXVII of 2021, the Digital Single Market (DSM) Directive copyright reform; the stored source states which act inserted it but not that act's own promulgation date.

Section 84/A(1) requires a database producer's consent before the whole or a substantial part of a database's contents is extracted (reproduced) or re-utilized (made available to the public).

Section 84/A(3) extends this to repeated and systematic extraction or re-utilization of even an insignificant part of the database, where that conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests, which reaches a scraper that repeatedly copies small amounts over time rather than the database in one pass. Section 84/A(5) confines the right to a database whose obtaining, verification, or presentation required substantial investment.

This transposes the EU Database Directive's sui generis right; the stored source does not carry a promulgation date for the section.

Section 6(2) requires the head of an organization within the Act's scope to establish and operate a risk-management framework for the electronic information systems in the organization's possession, following a directly applicable EU legal act or, in its absence, the decree of the minister responsible for informatics.

Section 6(3) to (5) list the concrete tasks the framework must cover: surveying and registering every electronic information system and central service used, appointing the person responsible for system security, classifying systems into a security category, applying protection proportionate to risk, issuing and periodically reviewing an information-security policy, and, for a public-administration, state-influenced or critical-infrastructure organization, spending at least 5 percent of annual IT development costs on cybersecurity.

Section 1 scopes the duty to an essential or important organization. The sector annexes (2. and 3. melléklet) reach an organization that qualifies as a medium-sized enterprise or larger under Hungary's SME Act, or that exceeds the thresholds the Act sets for one. Section 2(1)(c) separately reaches a provider of an online marketplace, online search engine or social-media service platform whose main place of business activity is in Hungary, even where the provider is established elsewhere.

Section 66(2) of the Act requires an organization under Section 1(1)(d) or (e) to notify the national cybersecurity incident-handling centre of a threat, near-incident or cybersecurity incident causing serious disruption or damage, as specified in a government decree. Section 66(1) imposes the equivalent duty, without that materiality filter, on a public-administration, state-influenced or critical-infrastructure organization under Section 1(1)(a) to (c) or (f).

Section 77(1) of Government Decree 418/2024 sets the clock those notifications run on. It requires an initial notification without undue delay and in any case within 24 hours of becoming aware of the incident. It requires an event notification within 72 hours that updates the initial report and assesses the incident's severity and impact.

It requires a final report no later than one month after that 72-hour event notification, or, if the incident is still ongoing at that point, a report on progress so far followed by a final report within one month of its resolution. Section 42 of the same Decree makes an infringement of either Section 66 or the Decree's own notification rules punishable by an administrative cybersecurity fine on the same NIS2-mirroring tiers as the risk-management duty.

Section 4/A(1) provides that information published by a service provider, other than media content covered by the Press Freedom Act, that could seriously harm a minor's intellectual, spiritual, moral, or physical development, in particular by having violence or the direct, naturalistic depiction of sexuality as a defining element, may be published only together with a warning notice about the possible endangerment of minors, displayed before the content, and identifiers in the page's source code that indicate the content's category and are recognizable by filter software as defined in the Electronic Communications Act.

A Child Protection Internet Roundtable oversees compliance and supports the development and spread of filter software. The Electronic Communications Act separately requires an internet-access provider to compile and publish information about the availability of easily installable minor-protection software and to notify subscribers of it quarterly.

Section 9(1) requires a media service provider to sort every programme it intends to publish, other than a fixed list of exceptions such as news, political information, sports, and trailer programmes, into one of the age-rating categories the section defines before it is broadcast; Section 9(2) puts a programme viewable regardless of age into category I. Section 11(1) requires an on-demand audiovisual media service to publish a programme only in the manner its category permits, and Section 11(1a) requires the age-rating category to be displayed prominently when a programme is presented in the service's catalogue or before the user views it.

Section 9's current text was substituted by Act LXXIX of 2021, Section 9, and further modified by Act LXI of 2022, Section 27; Section 11(1a)-(1b) was inserted by Act LXI of 2022, Section 23. The stored source does not carry a promulgation date for either amending act.

Section 82/A defines a press publication as a periodic or regularly updated publication, consisting mainly of journalistic literary works, published under a single title for the purpose of informing the public about news or other topics, on a service provider's initiative, editorial responsibility, and control; a periodical published for scientific purposes does not qualify.

Section 82/B(1) requires the press publication's publisher's consent before it is made available to the public in a way that lets members of the public access it from a place and at a time individually chosen by them, and before it is reproduced electronically for that purpose, where the use is by an information-society service provider.

Section 82/B(2) gives the publisher a right to remuneration for that use, and 82/B(3) obliges the publisher to give the publication's authors an appropriate share of the resulting revenue. Section 82/C exempts a hyperlink to the publication, single words or very short extracts of it, and an individual user's private or non-commercial use. Under Section 111/J(1), the publisher may exercise these exclusive rights only for uses occurring on or after 1 June 2021.