Search for:
Cybersecurity, Data and Tech

Hungary: Hungarian Cybersecurity requirements

By and 3 Mins Read

NIS2 implementation – New fines and classification rules

In brief

The Hungarian Government has published a new draft decree (“Draft“), which, once adopted, will establish new fines for failure to provide data, either within the deadline or at all, that is necessary for the registration of organizations under Act XXIII of 2023 on Cybersecurity Certification and Cybersecurity Supervision (“Cyber-certification Act“), which is the Hungarian transposition of the NIS2 Directive [Directive (EU) 2022/2555]. We recall that for numerous organizations, the above-mentioned deadline is 30 June 2024.

In addition to the above, Decree No. 7 of 2024 (VI. 24.) of the Cabinet Office of the Prime Minister (“Decree“) was adopted, which sets out the rules on the security classification of electronic information systems.

In depth

I. The Draft

Under the current version of the Draft, the following fines may be introduced:

1. In case of failure to provide data:

  • Minimum fine: 0.5% of the net turnover of the concerned organization in the previous financial year, but no less than HUF 5 million.
  • Maximum fine: 2% of the net turnover of the concerned organization in the previous financial year, but no more than HUF 150 million.

2. In case of the submission of data after the deadline:

  • Minimum fine: HUF 50,000.
  • Maximum fine: 0.1% of the net turnover of the concerned organization in the previous financial year, but no more than HUF 15 million.

Opinions on the Draft could be provided during the public consultation until 25 June 2024. Therefore, the adoption and publication of the Draft is expected shortly. Based on the Draft’s current version, the rules set out in the Draft will enter into force on 18 October 2024.

II. The Decree

The measures set out in the Decree must be applied by the organizations concerned from 18 October 2024, at the latest. A number of tasks related to the Decree require not only technical but also legal considerations. Examples for such tasks include:

  • The review of contracts with suppliers, contractors and subcontractors, that are related to electronic information systems, in the light of the requirements set out in the Cyber-certification Act.
  • The development and implementation of relevant processes and related policies in compliance with relevant laws, including, inter alia, labor and data protection laws, and/or the review of existing processes and policies, including, for example, the consideration of issues related to security and the assessment thereof, access and the related controlling mechanisms, logging and accountability, awareness and training, and policies on monitoring work phases.
  • The training of employees, with a particular focus on legal aspects of security incident management and rules on access rights.

Considering that achieving compliance with the requirements set out in the Decree may take a relatively long period of time, we recommend to take the compliance measures necessary as soon as possible. 

Categories:
Author

Csaba Vári is the Head of IPTech Practice Group in Budapest. With more than 20 years of experience Csaba represents Hungarian and multinational companies in many business sectors (e.g., automotive, manufacturing, bank, insurance, trade, pharma, real estate, IT) on a broad range of business law, including data privacy and cybersecurity issues and compliance investigations. Csaba has particularly broad experience in the field of data protection; he provides legal advice to our clients in connection with the EU General Data Protection Regulation (GDPR) and relevant Hungarian laws, and provides complex assessments of companies' data processing activities, GAP analysis, and assists in introduction of GDPR compliant data processes and policies. Csaba also assists clients in connection with Data Subject Access Rights related matters, Intra Group Data Transfer Agreements, transfers of personal data to third countries, and assessments of legal basis for data processes (e.g., legitimate interest balancing tests, data privacy impact assessments). Csaba assists his clients in addressing legal issues in connection with processing of consumer and employee data, and data privacy aspects of online applications. His area of expertise includes advising on operation of surveillance systems, and preparation and operation of whistleblowing schemes. Csaba has particular experience in the area of cyber investigations and cyber incident management. He represents clients before the National Authority for Data Protection and Freedom of Information (Hungarian DPA) in connection with data breach reporting and registering Data Protection Officers.

Author

Dr. Andras Gaal is an Associate, in Baker McKenzie, Budapest office.

Related Posts