What Is Act CXII of 2011 ("Info tv.") + GDPR?
Hungary's principal privacy statute is Act CXII of 2011, known as the Info tv., while the GDPR remains the primary rights source for GDPR-covered processing. The current consolidated NJT text is dated 26 August 2026 and reflects amendments through Act XVIII of 2026. The Info tv. does not wholesale incorporate its own §§14-22 into ordinary GDPR-covered processing. Instead, GDPR Articles 12-22 remain the main rights framework, with specified Hungarian provisions supplying procedural, enforcement, and penalty overlays. No general Hungarian derogation was located for those GDPR rights. NAIH provides a free notification/investigation route with a two-month statutory investigation period and a formal data-protection authority proceeding with a 150-day processing deadline. NAIH also publishes a separate Data Governance Act supervision procedure for data-intermediation services providers, including a 150-day administrative limit and possible compliance measures; this is a regulator-supervision route, not a consumer self-service deletion form.
At a glance
- Full name
- Act CXII of 2011 ("Info tv.") + GDPR
- Short code
- Info tv. + GDPR
- Jurisdiction
- Hungary
- Enacted
- 2011
- Last major update
- Current consolidated NJT text dated 26 August 2026, incorporating amendments through Act XVIII of 2026
- Regulator
- Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
- Private right of action
- Limited
- Statutory citation
- Act CXII of 2011 ("Info tv.") + GDPR
Scope, who Info tv. + GDPR covers
Protected data
Data subject rights
GDPR Articles 12-22 remain the primary source of transparency, access, rectification, erasure, restriction, objection, portability, and automated-decision rights for ordinary GDPR-covered processing
Formal NAIH proceedings may seek rights compliance, correction, erasure, restriction, transfer suspension, and other GDPR measures
A free notification may be submitted to NAIH, including anonymously in some circumstances, electronically or by post
No standalone Hungarian provision was located that expressly disapplies specified Chapter III rights for journalism, academic, artistic, or literary expression
Notable features
Hungary combines directly applicable GDPR rights with a national supplementary statute whose listed provisions include NAIH procedures, enforcement, and penalties. A separate statute governs national identification codes. No standalone Hungarian expression-related Chapter III derogation was located in the reviewed Info tv. materials.
Enforcement & penalties
Regulator: Hungarian National Authority for Data Protection and Freedom of Information (NAIH)
Penalties: GDPR Article 83 administrative-fine rules apply to ordinary GDPR-covered controllers and processors. Info tv. §75/A requires NAIH to exercise those powers proportionately and, for a first infringement, primarily seek remediation through a warning. The HUF 100,000-20,000,000 range applies only in limited contexts, including certain non-GDPR law-enforcement, national-security, or defense processing and GDPR fines where the liable payer is a budgetary organ; it is not a universal fine schedule for ordinary Hungarian controllers.
Private right of action: NAIH investigation and formal authority proceedings, including possible erasure and other compliance orders, are the identified mechanisms; no general private damages action was identified.
Relevance to data brokers
NAIH publishes an official Data Governance Act supervision procedure for data-intermediation services providers. The guide requires an identified provider, an alleged-infringement description, supporting facts or evidence, and an explicit remedy request; it states a 150-day administrative time limit and allows cessation, suspension, and fines in qualifying cases. This is a regulator-supervision route, not a consumer self-service opt-out or deletion form. The general GDPR and NAIH notification or formal-authority routes remain available, while public-information provisions are not a dedicated consumer deletion route for personal information in public records.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Does Hungary have a separate privacy law in addition to the GDPR?+
Yes. Act CXII of 2011, the Info tv., applies alongside the GDPR. For ordinary GDPR-covered processing, GDPR Articles 12-22 remain the primary rights source, while specified Hungarian provisions provide procedural, enforcement, and penalty overlays.
How long does NAIH have to investigate a notification?+
The statutory investigation deadline is two months from the day after notification, subject to exclusions for fact clarification, translation, and certain unavoidable disruptions. A formal authority proceeding has a separate 150-day statutory processing deadline.
Does Hungary have a dedicated data-broker deletion route?+
NAIH publishes a regulator-supervision procedure for data-intermediation services providers under the Data Governance Act. It is not a consumer self-service deletion form: the guide requires provider-identification information, an alleged-infringement description, supporting evidence, and an explicit remedy request, with a stated 150-day administrative time limit.
Official sources & citations
Other international privacy regimes
Info tv. + GDPR sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: