Fri, Jul
67 New Articles

Amendments to the Hungarian Data Protection Act

Amendments to the Hungarian Data Protection Act

  • Smaller Small Medium Big Bigger
  • Default Helvetica Segoe Georgia Times

The Hungarian Parliament has recently adopted legislation with the aim of harmonising the national data protection rules with the rules of the GDPR, and supplementing the national rules in areas not regulated by the GDPR. The Parliament adopted Act XXXVIII of 2018 ("Amendment") in an extraordinary session and the new regulations entered into force on 26 July 2018.

For background, the entry into force of the GDPR created a "patchwork" regulation in which besides the GDPR, the national data protection act - Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information ("Act") - and several sectorial laws remained in force in unchanged form. This led to contradictions in the regulations and general legal uncertainty surrounding the topic. Though the new legislation is not a comprehensive review of all data protection-related regulations, it aims to clarify some important issues regarding the parallel application of the GDPR and the Act.

Scope of application of the Act

Unless otherwise prescribed by law or European regulation, data controllers or processors must apply the rules of the Act if

a) the controller's main establishment or the controller's only place of business within the EU is in Hungary or;

b) the controller's main establishment or the controllers' only place of business within the EU is not located in Hungary, but the data processing activity is connected to

  • providing goods or services to data subjects staying in Hungary or 
  • monitoring data subjects' behaviour inside the territory of Hungary.

Most important novelties

Below we summarise the most important rules of the Amendment, which change the current legislation and/or supplement the GDPR:

(i) Legal base of mandatory data processing: If the data controller must process personal data to comply with its legal obligation, the legal base of the data processing activity must be based on an act issued by the Hungarian Parliament or a decree issued by the local government. If such laws (act or the local government's decree) do not provide a legal basis for the data processing activity, but the processing is necessary to the controller to fulfil its tasks set out by law, the controller must obtain the prior consent of the data subjects.

(ii) Mandatory review of data processing activity: If the data processing is mandatory (i.e. required by law), and the period or the necessity of revision of data processing activities is not determined by law or an EU act, the controller must revise its data processing activities at least every three years. The aim of the review is to decide whether the data processing activity is still necessary to achieve the original purpose. The revision must be documented and be retained for ten years.

(iii) Examination of the data subject's request: The controller must provide information on action taken at the request of the data subject within 25 days.

(iv) Rights of deceased persons: In five years after the death of the data subject, his/her rights relating to data processing may be exercised by an authorised person. In the absence of an authorisation, close relatives are entitled to exercise the deceased person's rights.

(v) Abolishment of the central data protection register of the authority: The Amendment abolishes the requirement of registering data processing activities with the supervisory authority. As a result, data controllers may process personal data without registration. Controllers will be required to keep their own registers as required by the GDPR.


The Amendment represents a significant step in harmonising the national legislation with the GDPR, but it leaves some loopholes (e.g. harmonisation of the sectoral data protection rules). These will presumably be subject to broader data protection reform that is expected in the autumn session of Parliament. In this transition period, the assistance of qualified legal advisors to achieve compliance with the GDPR and the multiple national data protection laws is of even higher importance.

By Daniel Gera, Counsel, Dorottya Gindl, Associate, Schoenherr

Hungary Knowledge Partner

Nagy és Trócsányi was founded in 1991, turned into limited professional partnership (in Hungarian: ügyvédi iroda) in 1992, with the aim of offering sophisticated legal services. The firm continues to seek excellence in a comprehensive and modern practice, which spans international commercial and business law. 

The firm’s lawyers provide clients with advice and representation in an active, thoughtful and ethical manner, with a real understanding of clients‘ business needs and the markets in which they operate.

The firm is one of the largest home-grown independent law firms in Hungary. Currently Nagy és Trócsányi has 26 lawyers out of which there are 8 active partners. All partners are equity partners.

Nagy és Trócsányi is a legal entity and registered with the Budapest Bar Association. All lawyers of the Budapest office are either members of, or registered as clerks with, the Budapest Bar Association. Several of the firm’s lawyers are admitted attorneys or registered as legal consultants in New York.

The firm advises a broad range of clients, including numerous multinational corporations. 

Our activity focuses on the following practice areas: M&A, company law, litigation and dispute resolution, real estate law, banking and finance, project financing, insolvency and restructuring, venture capital investment, taxation, competition, utilities, energy, media and telecommunication.

Nagy és Trócsányi is the exclusive member firm in Hungary for Lex Mundi – the world’s leading network of independent law firms with in-depth experience in 100+countries worldwide.

The firm advises a broad range of clients, including numerous multinational corporations. Among our key clients are: OTP Bank, Sberbank, Erste Bank, Scania, KS ORKA, Mannvit, DAF Trucks, Booking.com, Museum of Fine Arts of Budapest, Hungarian Post Pte Ltd, Hiventures, Strabag, CPI Hungary, Givaudan, Marks & Spencer, CBA.

Firm's website.

Our Latest Issue