Meet Hungary's Info Act and GDPR duties from one set of controls

The Info Act is Hungary's Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information. It is the national data protection and freedom of information law, in force since 1 January 2012. Since its 2018 amendment it supplements the GDPR for most processing, sets up the NAIH and its procedures, and fully regulates processing for law enforcement, national security and defence purposes.

Both apply. The GDPR applies directly to most processing of personal data, and the Info Act adds Hungarian supplementary rules, such as NAIH procedures, court remedies and the exercise of rights after a data subject's death. For law enforcement, national security and defence processing, which falls outside the GDPR, the Info Act's own data protection chapters apply in full.

Every controller and processor handling personal data in Hungary must comply, whether a private company or a public body. Businesses mainly meet the GDPR plus the Act's supplementary provisions. Public bodies also have freedom of information duties to disclose and publish data of public interest, and law enforcement, national security and defence bodies follow the Act's full data protection regime.

The National Authority for Data Protection and Freedom of Information (NAIH) enforces it, through investigations and data protection authority proceedings. For processing within the GDPR's scope, fines follow GDPR Article 83. For processing under the Act's own regime, the NAIH can impose fines from HUF 100,000 to HUF 20 million. Individuals can also sue controllers and processors for damages in court.

Yes, where the GDPR requires one, and under the Info Act's own regime a controller or processor must appoint a data protection officer if it performs state or other public tasks, other than the courts, or if a law requires it. Controllers must notify the NAIH of the officer's contact details and publish them.

The Info Act is a legal obligation, while ISO 27001 is a voluntary certifiable standard for information security management. ISO 27001 controls help meet the Act's and the GDPR's data security, breach handling and access requirements, but certification does not prove legal compliance. Many organisations use ISO 27001 as the security backbone of their Hungarian privacy programme.

Start with GDPR compliance, then add the Hungarian specifics. Map your processing activities, confirm lawful bases, keep records of processing, run impact assessments where needed, handle breaches and notify the NAIH, and appoint a data protection officer where required. Check the Hungarian consolidated text for current wording, as the Act is amended regularly.

Yes. OneClickComply supports the Hungarian Info Act today. Because it builds on controls shared with the GDPR, evidence you already collect for GDPR can count towards it. OneClickComply does not issue certifications or guarantee legal compliance, and Ask an Auditor can help with Hungarian questions.