ITER/HUHungary
What the record establishes for Hungary: the bodies an insider event is reported to, the channel each takes, and the act that transposes the NIS2 Directive, Directive (EU) 2022/2555.
Recipients
| Reached under | Body | Channel | Source |
|---|---|---|---|
| Data protection authorityGDPR, article 33 | Hungarian National Authority for Data Protection and Freedom of Information reported | — | edpb members |
| CSIRT or competent authorityNIS2, article 23 | The national cybersecurity incident handling center, the Központ, with the SZTFH as the supervisory authority reported | https://incidens.nki.gov.hu/checked 2026-09-03 The National Cyber Security Institute takes notifications around the clock, on a web form at incidens.nki.gov.hu, by e-mail to CSIRT@nki.gov.hu, and by telephone. It also runs an anonymous route, which is a different thing from the duty in the decree and is not it. | hu 418 2024 korm rendelet · nki incidens bejelentes |
| Financial supervisorDORA, article 19 | Magyar Nemzeti Bank reported | — | eba competent authorities |
| Market authorityMAR, article 17 | Magyar Nemzeti Bank (MNB) reported | — | esma mar nca |
Transposition of NIS2 binding
| Act | 2024. évi LXIX. törvény Magyarország kiberbiztonságáról |
|---|---|
| In force | 1 January 2025, by § 82(1), with § 120(1) a day later. The implementing decree is 418/2024. (XII. 23.) Korm. rendelet. |
| Recipient | The national cybersecurity incident handling center, the Központ, with the SZTFH as the supervisory authority |
| Moves a term | No. None in the terms, but they are not where an organization would look. The act contains no hour at all: a search of its whole text returns no expression of hours for notification, because § 66 states the duty and leaves the detail to a government decree. The terms are in § 77 of decree 418/2024: a first notification «a kiberbiztonsági incidensről való tudomásszerzéstől számított 24 órán belül», an event notification «72 órán belül» on the same anchor, an interim situation report at the Centre's request, and a closing report «legkésőbb a 3. pont szerinti eseménybejelentés benyújtását követő egy hónapon belül». All of it runs from becoming aware, as the Directive has it. |
| Standing | Both instruments were read: the act, and the decree that carries the cascade. Hungary is the second country in this record built this way, after Croatia. In both, reading the transposing act and stopping produces the conclusion that there are no deadlines. |
| Source | hu 418 2024 korm rendelet |
An event in Hungary
The five types, each opened on this jurisdiction: the acts it obliges, the term on each, and where the report goes.