INTRA/HUHungary

What the record establishes for Hungary, measure by measure, and what each source requires of the measure it governs.

Binding: 22
Recommended: 0
Reported: 0
Measures touched: 22 of 110
Sources cited: 9

Control	Source	What it establishes	Prerequisite or recommendation
22Mandatory
AW001/HU Workforce awareness on insider riskMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in all three security classes, the organization gives training on recognizing and reporting the potential signs of insider threats.
AW002/HU Transparency notice on what is observedMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Before a restriction of the employee’s personality right, the employee is informed in writing of its manner, conditions, and expected duration and of the circumstances supporting its necessity and proportionality; before technical means are used to check the employee, the employee is informed in writing. The notice on cameras states the basis, the place and duration of storage, the security measures, who may view and to whom recordings may go, the rules of review and the purposes of use, and the employees’ rights and remedies, for each camera its purpose and field of view; a general statement that cameras are in use is not accepted.
BA003/HU Multidisciplinary case reviewMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	An insider threat program with a multidisciplinary team handling insider security events is in the protective measures catalogue and is marked as required for none of the three security classes.
CP005/HU Referral to law enforcementMandatory	2023. évi XXV. törvény a panaszokról, a közérdekű bejelentésekről, valamint a visszaélések bejelentésével összefüggő szabályokról, 18. § to 23. §, 54. §, and 56. §https://njt.jog.gov.hu/jogszabaly/2023-25-00-00 · read 5 Oct 2026	That an employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, that employers of 50 to 249 were reached on 17 December 2023 and may run it jointly, that it is operated by a designated impartial person or unit or by a whistleblower-protection lawyer or other external organization under the same impartiality rules, that a written report is acknowledged within seven days, that the investigation closes within thirty days of receipt, extendable with reasons to a maximum of three months, and that the reporter of an oral report is told that their identity is treated confidentially at every stage.	Where a report through the internal system warrants criminal proceedings, the operator arranges for a criminal complaint to be filed.
DP002/HU Information classification schemeMandatory	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For the organizations in annex 1 of the Act, the head of the organization ensures the survey and classification of the data processed in the systems, and the result is one basis of the security classification.
DP004/HU Access control and least privilegeMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Biometric data of an employee may be processed for identification only where needed to prevent an unauthorized access to a thing or data that would risk grave or mass, irreversible harm to life, health, or a significant interest protected by law, the list naming classified data, firearms, dangerous substances, nuclear material, and property of especially large value.
DP005/HU Privileged access managementMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in the “jelentős” and “magas” classes, the system logs the execution of privileged functions.
DP006/HU Access recertificationMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in the “jelentős” and “magas” classes, the organization reviews at set intervals the privileges accessible to roles or user groups to verify their necessity and reassigns or removes them.
DP014/HU Personal material in company accountsMandatory	NAIH/2019/51/11, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That storing a former employee’s private correspondence in archived mailboxes breached storage limitation, that searching those archives for documents without proper information and without a basis breached fairness and purpose limitation, that the absence of technical and organizational measures and of information on the use and archiving of employees’ mailboxes breached accountability, and that the fine was 500,000 HUF.	The internal policy on the company e-mail account and laptop states whether private use is allowed, the rules on backup and deletion, and the rules of checking; where private use of a laptop is allowed the private data sit on a separate partition outside the backup and the check; where it is not allowed, the employer may record that private data were stored and not what they were. Keeping a former employee’s private correspondence in archived mailboxes breaches storage limitation, and the employer identifies and deletes it with the person’s involvement, letting the person copy the purely private data first.
GV001/HU Program charter and mandateMandatory	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For organizations in scope, the head of the organization establishes and operates the risk management framework, registers the systems, defines the roles and responsibilities, appoints the person responsible for the security of the electronic information system, issues the information security policy and reviews it at least every two years, and decides on taking systems into use.
GV002/HU Declared perimeterMandatory	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For organizations in scope, each electronic information system is classified into the “alap”, “jelentős”, or “magas” security class on the risk to its integrity and availability and to the confidentiality, integrity, and availability of its data, and the measures the decree assigns to that class are implemented; the classification is reviewed at least every two years.
GV007/HU Lawful basis registerMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Consent is a basis for workplace processing only exceptionally, where the employee gains an unconditional advantage and suffers no disadvantage from refusing; checks of employees rest on the employer’s legitimate interest with a documented balancing test in five steps. The employer may require a statement or personal data from the employee only where material to the establishment, performance, or termination of the employment or to a claim under the Act, and informs the person in writing of the processing; a restriction of the employee’s personality right stands only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate.
GV010/HU Worker representative engagementMandatory	2012. évi I. törvény a munka törvénykönyvéről, 264. §Országgyűlés · read 5 Oct 2026	That the employer seeks the works council’s opinion at least fifteen days before deciding on draft measures and policies affecting a larger group of employees, and that the processing and protection of employees’ personal data and the use of technical means to check the employee are such measures.	At least fifteen days before deciding, the employer seeks the works council’s opinion on draft measures and policies affecting a larger group of employees, among them the processing and protection of employees’ personal data and the use of technical means to check the employee; the section gives an opinion right and does not make the measure depend on agreement.
GV013/HU Periodic program reviewMandatory	2024. évi LXIX. törvény Magyarország kiberbiztonságáról, 6. §, 10. §, 11. §, and 82. §Országgyűlés · read 5 Oct 2026	That the head of the organization establishes and operates a risk management framework, registers the systems, defines roles and responsibilities and appoints the person responsible for the security of the electronic information system, classifies the data, classifies each system into the “alap”, “jelentős”, or “magas” security class, determines and ensures the protective measures of that class, issues an information security policy reviewed at least every two years, evaluates the measures periodically, decides on taking systems into use, and reports threats, near-incidents, and incidents to the competent incident handling centre; and that the classification is reviewed at least every two years.	For organizations in scope, the head of the organization ensures the periodic evaluation of the protective measures, by risk analyses, checks, and an internal cybersecurity evaluation on the authority’s recommendation, remedies the deficiencies found, and reviews the security classification at least every two years or without delay on a change affecting security.
GV014/HU Answering a request from the personMandatory	NAIH/2020/34/3, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That a former employer unlawfully refused a former employee access to the private e-mails in the archive of the work mailbox, that it failed to facilitate the right of access by not giving transparent information on the measures taken, that it is ordered to identify the private e-mails with the person’s involvement and give access to them, that access to the work-related e-mails was not ordered, and that the fine was 200,000 HUF.	A former employee has a right of access to the private e-mails in the archive of the work mailbox and the former employer identifies them with the person’s involvement and gives access; access to the work-related e-mails was not ordered; the fine for the refusal and for the want of transparent information on the measures taken was 200,000 HUF.
IV001/HU Internal reporting channelMandatory	2023. évi XXV. törvény a panaszokról, a közérdekű bejelentésekről, valamint a visszaélések bejelentésével összefüggő szabályokról, 18. § to 23. §, 54. §, and 56. §https://njt.jog.gov.hu/jogszabaly/2023-25-00-00 · read 5 Oct 2026	That an employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, that employers of 50 to 249 were reached on 17 December 2023 and may run it jointly, that it is operated by a designated impartial person or unit or by a whistleblower-protection lawyer or other external organization under the same impartiality rules, that a written report is acknowledged within seven days, that the investigation closes within thirty days of receipt, extendable with reasons to a maximum of three months, and that the reporter of an oral report is told that their identity is treated confidentially at every stage.	An employer with at least 50 persons in an employment relationship operates an internal abuse reporting system, those of 50 to 249 from 17 December 2023 and jointly if they choose; it is run by a designated impartial person or unit, or by a whistleblower-protection lawyer or other external organization under the same impartiality rules; a written report is acknowledged within seven days, the investigation closes within thirty days of receipt, extendable with reasons to three months at most, and the reporter is told that their identity is treated confidentially at every stage.
MD004/HU Endpoint activity monitoringMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026NAIH/2019/769, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	The employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; a device the employer provides for work is used only for the employment unless agreed otherwise, and the employer may inspect the employment-related data stored on it, including the data needed to check that restriction. Checking an employee’s e-mail account and devices without internal rules and without prior information breaches fairness and accountability; the employer adopts the internal rules and the notice and runs checks under them; the fine was 1,000,000 HUF.
MD006/HU Electronic mail and collaboration monitoringMandatory	NAIH/2019/51/11, határozatNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026A NAIH tájékoztatója a munkahelyi adatkezelések alapvető követelményeirőlNemzeti Adatvédelmi és Információszabadság Hatóság · read 5 Oct 2026	That storing a former employee’s private correspondence in archived mailboxes breached storage limitation, that searching those archives for documents without proper information and without a basis breached fairness and purpose limitation, that the absence of technical and organizational measures and of information on the use and archiving of employees’ mailboxes breached accountability, and that the fine was 500,000 HUF.	The company e-mail account is checked under an internal policy, on the employer’s legitimate interest after a balancing test, in steps: first the address and the subject, then the traffic data that narrow the search, and content only where the private character can be excluded; the employee is present as a rule; the notice states the purposes, who checks, the steps, and the remedies. Searching archived mailboxes for documents without proper information and without a basis breaches fairness and purpose limitation, and the want of measures and information on the use and archiving of mailboxes breaches accountability; the fine was 500,000 HUF.
MD017/HU Monitoring on worker-owned devicesMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Where by agreement the employee uses their own device for the employment, the employer’s right to inspect the employment-related data stored on it applies.
PS001/HU Pre-employment screeningMandatory	2012. évi I. törvény a munka törvénykönyvéről, 9. §, 10. §, 11. §, and 11/A. §Országgyűlés · read 5 Oct 20267/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an employee’s personality right may be restricted only where strictly necessary for a reason directly connected with the purpose of the employment and proportionate, with prior written information on the manner, conditions, expected duration, and the circumstances supporting necessity and proportionality; that the employee may be checked in the conduct connected with the employment, by technical means too, after prior written information; that a device provided for work is used only for the employment unless agreed otherwise and the employer may inspect the employment-related data stored on it; that biometric data serve identification only against grave unauthorized access; and that criminal record data may be processed to check a restriction or exclusion the employer has set out in writing beforehand.	Criminal record data of an employee or candidate may be processed to check whether a restriction or exclusion set by law or by the employer applies to the position, the employer may set such a condition only where employment in the position would endanger a significant financial interest, a secret protected by law, or the interests named in section 11(2)(b) to (d), and the employer sets the condition and the terms of processing out in writing beforehand. For systems in all three security classes, every position carries a risk classification with screening criteria for the persons filling it, and persons are screened before being allowed access to the system.
PS002/HU Risk-tiered screening standardsMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in all three security classes, the risk classification of positions and the screening criteria are reviewed at a set frequency; screening for persons with access to information needing special protection is in the catalogue and marked for no class.
PS004/HU Screening during employmentMandatory	7/2024. (VI. 24.) MK rendelet a biztonsági osztályba sorolás követelményeiről, valamint az egyes biztonsági osztályok esetében alkalmazandó konkrét védelmi intézkedésekről, 2. mellékletMiniszterelnöki Kabinetiroda (the minister responsible for informatics) · read 5 Oct 2026	That an insider threat program with a multidisciplinary team handling insider security events is in the catalogue and is marked for none of the three classes; that awareness training on recognizing and reporting potential signs of insider threats is required in all three classes; that a risk designation of every position with screening criteria, screening of persons before access and re-screening on change of authorization or position or periodically, and a termination process that disables access within a defined time, revokes all credentials and authorizations, holds an exit interview on information security, and retrieves security assets are required in all three classes; and that the periodic review of privileges and the logging of privileged functions are required in the “jelentős” and “magas” classes.	For systems in all three security classes, persons are re-screened at a set frequency and when their authorization level or position changes.