Cybersecurity law & regulation in Hungary (2026)

Legal framework

Act LXIX of 2024 on Cybersecurity in Hungary (in force 1 January 2025), transposing EU NIS2 Directive (2022/2555); implemented by Government Decree 418/2024 (XII.23.); supervised by SZTFH (private sector) and NBSZ/national CERT (public sector)

NIS2 & cybersecurity law in Hungary

In Hungary, baseline cybersecurity obligations come from the EU NIS2 Directive, transposed into national law, which sets risk-management and incident-reporting duties for essential and important entities.

Framework

the NIS2 Directive (EU) 2022/2555, transposed into national law

Approach

cybersecurity risk-management measures plus mandatory incident reporting for in-scope entities

Applies to

medium and large entities in critical sectors: energy, transport, banking, health, water, digital infrastructure, ICT and public administration

Incident reporting

an early warning within 24 hours and a full notification within 72 hours to the national CSIRT

Maximum fine

up to €10 million or 2% of global annual turnover for essential entities

Oversight

the national competent authority and CSIRT designated under NIS2

NIS2 is a directive, so Hungary implements it through national law; exact scope and deadlines can vary slightly by transposition.

Key points: cybersecurity in Hungary

1. 01Primary Legislation

   Act LXIX of 2024 on Cybersecurity (Magyar Közlöny) entered into force 1 January 2025, repealing Act XXIII of 2023. It is the sole comprehensive cyber statute covering both public and private sector networks and information systems, supplemented by Government Decree 418/2024 (XII.23.) on implementation details.

   njt.hu cms-lawnow.com

2. 02Scope & Sector Coverage

   Covers medium and large enterprises (≥50 employees or >€10 M turnover/balance sheet) in high-risk sectors (energy, transport, healthcare, digital infrastructure, electronic communications) and risky sectors (postal, food, chemicals, electronic manufacturing, digital services). SMEs are generally excluded unless designated critical.

   schoenherr.eu digital-strategy.ec.europa.eu

3. 03Security Classification

   Systems are assigned one of three security classes, 'basic', 'significant', or 'high', replacing the prior five-tier system. The 'high' class applies to critical infrastructure systems whose compromise could have the most severe societal or economic impact.

   cms-lawnow.com njt.hu

4. 04Incident Reporting & Breach Notification

   In-scope entities must submit an early warning to NBSZ within 24 hours of discovering a significant incident, followed by a full incident notification within 72 hours. These obligations run in parallel with GDPR personal-data breach notifications and do not substitute for them.

   resourcehub.bakermckenzie.com njt.hu

5. 05Supervisory Authorities & Penalties

   SZTFH (Supervisory Authority for Regulated Activities) is the NIS2 competent authority for the private sector; NBSZ (Special Service for National Security) supervises public-sector and state-owned entities and operates the national CERT. Failure to undergo a mandatory cybersecurity audit can result in fines of up to 2% of annual worldwide revenue (minimum HUF 1 million, maximum HUF 150 million).

   schoenherr.eu practiceguides.chambers.com

6. 06Cyber Resilience Act & Audit Deadlines

   Hungary adopted Act CXXXV of 2025 to implement the EU Cyber Resilience Act, published in the Hungarian Official Journal in late 2025. The deadline for entities to complete their first mandatory cybersecurity audit was extended (by amendment in force 31 May 2025) to 30 June 2026. The European Commission issued a reasoned opinion in May 2025 citing incomplete NIS2 transposition.

   cms-lawnow.com eur-lex.europa.eu

NIS2 in Hungary: FAQ

Timeline of decisions

1. 7 May 2025Enforcement · official
   European Commission Reasoned Opinion: Hungary Cited for Incomplete NIS2 Transposition

   The Commission sent a formal reasoned opinion to Hungary (among 19 Member States) for failing to notify complete NIS2 transposition measures, despite Hungary having enacted Act LXIX of 2024. Hungary has two months to respond or face referral to the Court of Justice of the EU.

   European Commission

2. 31 Mar 2025Decision
   Government Decision 1089/2025: National Cybersecurity Strategy 2025-2030 Adopted

   Hungary adopted a new five-year cybersecurity strategy required by Article 7 of NIS2, tasking the Cybersecurity Commissioner and relevant ministers with developing a National Cybersecurity Action Plan and integrating cybersecurity across public administration, critical infrastructure, digital services, and supply chains.

   CEE Legal Matters / Government Decision 1089/2025

3. 1 Jan 2025Law · official
   Act LXIX of 2024 on Cybersecurity Enters into Force, Full NIS2 Consolidation

   Hungary's comprehensive Cybersecurity Act took effect, repealing the 2013 Information Security Act and the 2023 partial transposition law and merging public-sector and private-sector cybersecurity obligations into a single statute. The Regulated Activities Supervisory Authority (SzTFH) became the primary supervisory body; mandatory cybersecurity audits must be completed by 30 June 2026.

   National Legal Database of Hungary (njt.hu)

4. 30 Jun 2024Guidance
   Deadline: NIS2 Entity Registration Under Act XXIII of 2023

   All organisations falling within Hungary's initial NIS2 scope were required to register with the competent authority by this date, representing the first active compliance milestone under the early NIS2 framework before the comprehensive 2024 Act replaced it.

   DLA Piper (citing Act XXIII of 2023)

5. 1 May 2023Law · official
   Act XXIII of 2023, Hungary's First NIS2 Transposition Step

   Hungary became one of the earliest EU Member States to begin NIS2 implementation, enacting a law on Cybersecurity Certification and Cybersecurity Supervision; it covered registration, supervision, and certification but was later found to be an incomplete transposition, necessitating the broader 2024 Act.

   European Commission

6. 1 Jan 2015Decision · official
   National Cyber Security Centre (NCSC-HU) Established

   Hungary unified three separate cyber bodies, GovCERT-Hungary (incident handling), the National Electronic Information Security Authority (NEISA), and the Cyber Defence Management Authority (CDMA), into a single National Cyber Security Centre, which became Hungary's national CSIRT and the competent authority under the subsequent NIS Directive.

   NCSC Hungary (official site)

7. 1 Jul 2013Law · official
   Act L of 2013 on Electronic Information Security of State and Municipal Bodies

   Hungary's foundational cybersecurity statute imposed binding obligations on state and municipal bodies, critical infrastructure operators, and their IT suppliers to classify information systems into security classes and implement commensurate controls, establishing the first comprehensive public-sector cybersecurity regime in Hungary.

   National Legal Database of Hungary (njt.hu)

8. 21 Mar 2013Decision · official
   Government Decision 1139/2013: First National Cybersecurity Strategy

   Hungary became one of the first Central and Eastern European states to adopt a national cybersecurity strategy, defining protecting critical information infrastructure as a national security priority, assigning institutional responsibilities, and providing the policy mandate for the 2013 Information Security Act and subsequent NCSC creation.

   Government of Hungary (English translation via NSA Archive, GWU)

9. 1 Jan 2012Law · official
   Act CLXVI of 2012 on Identification, Designation and Protection of Critical Systems

   Hungary enacted its critical infrastructure protection law, establishing the legal framework for identifying and designating critical systems and facilities across energy, transport, water, and telecommunications sectors, creating the statutory foundation for sector-specific cybersecurity and resilience obligations.

   National Legal Database of Hungary (njt.hu)

10. 1 Jul 2004Law · official
    Budapest Convention on Cybercrime Enters into Force for Hungary

    After Hungary signed the Council of Europe Convention on Cybercrime (23 November 2001, in Budapest) and ratified it on 4 December 2003, the treaty took effect, aligning Hungarian criminal law with international cybercrime standards; domesticated by Act LXXIX of 2004 and later reinforced by the Criminal Code (Act C of 2012).

    Council of Europe

Sources

1. 1.njt.hu/jogszabaly/en/2024-69-00-00
2. 2.cms-lawnow.com/en/ealerts/2025/01/hungary-introduces-new-comprehensive-laws-for-nis2
3. 3.schoenherr.eu/content/the-digital-defence-line-hungary-adopts-comprehensive-cyberse
4. 4.digital-strategy.ec.europa.eu/en/policies/nis2-directive-hungary
5. 5.resourcehub.bakermckenzie.com/en/resources/global-data-and-cyber-handbook/emea/hungary/topics/secur
6. 6.schoenherr.eu/content/cybersecurity-in-hungary-how-to-avoid-million-forint-fines-in
7. 7.practiceguides.chambers.com/practice-guides/cybersecurity-2025/hungary/trends-and-developments
8. 8.cms-lawnow.com/en/ealerts/2026/01/eu-cyber-resilience-act-s-implementing-provisions-
9. 9.eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=IMMC:LET/2025/02191