NIS2 in Hungary
2024. évi LXIX. törvény Magyarország kiberbiztonságáról
Law in force since
- Law
- Kiberbiztonsági tv.
- Authority
- Regulatory Authority for Regulated Activities (SZTFH)
- Classes
- alapvető szervezet (essential), fontos szervezet (important)
- Register
- SZTFH cybersecurity register
- ISO 27001
- Helps, not enough alone
- Self-check
- SZTFH cybersecurity supervision page
Know when Hungary changes its NIS2 rules
- One email when the law, the deadlines or the portal change.
The law
The Act took effect on 2025-01-01. Decree 418/2024 (XII. 23.) implements it. Private entities in the NIS2 sectors fall under the Act if they are medium-sized or larger. Micro and small entities fall under it only in the cases listed in section 1(1)(e).
- Name
- 2024. évi LXIX. törvény Magyarország kiberbiztonságárólAct LXIX of 2024 on the Cybersecurity of Hungary
- Published
- 2024-12-20
- In force
- 2025-01-01
- Text
- Read the Kiberbiztonsági tv.
Who is in scope
Annex I and II activities are in scope from 50 staff, or when turnover and balance sheet both pass EUR 10 million. Large Annex I companies are essential. Most others are important.
Where Hungary differs
- Section 1(1)(d)-(e) of the Act Medium-sized entities in the NIS2 sectors fall under the Act. Entities with 50 or more staff, or revenue above EUR 10 million, also fall under it. Some entity types fall under it at any size.
Also note
- SZTFH supervises private entities in groups d) and e). A separate national authority supervises other entity groups.
Registration
Send your data to SZTFH within 30 days after you start operating or fall under the Act. Report changes within 14 days. The Act sets the register data in section 29.
- Portal
- SZTFH cybersecurity register
- Rule
- Deadline counts from the day you come into scope
- Later entrants
- 30 days after the rules first apply to you
- You need
- The data set in section 29(1)(a) of the Act, sent to SZTFH. The SZTFH page does not name an online form.
- Changes
- Report changes to your data within 14 days
Incident reporting
- 24 hEarly warning
- 72 hIncident notification
- 1 monthFinal reportafter the 72-hour incident notification
Send the reports to the National Cybersecurity Incident Response Centre.
Entities of the d) and e) groups report only incidents that cause serious disruption or major damage. They may report other incidents voluntarily.
Measures and proof
- Essential
- The entity must pass a cybersecurity audit every 2 years. A registered auditor performs it. The first audit is due within 2 years after registration.
- Important
- The same audit duty applies. The authority can also order an audit. Micro enterprises outside section 1(1)(d) are exempt from the periodic audit.
The dates, in order
- Act in force
- Auditor agreement due for entities operating before 2025-01-01
- First audit due for entities operating before 2025-01-01
Duties of management
The head of the organisation sets up and runs the risk management framework. The head must make the organisation cooperate with the authority. The authority can fine a head who breaks a legal duty, and must fine repeat breaches.
Fines
The ceiling is the higher of a fixed amount and a share of the annual turnover of the entity itself.
| Class | Ceiling | At EUR 20m | At EUR 500m | At EUR 2bn |
|---|---|---|---|---|
| Essential | EUR 10m or 2% | EUR 10m | EUR 10m | EUR 40m |
| Important | EUR 7m or 1.4% | EUR 7m | EUR 7m | EUR 28m |
The Decree sets the euro ceiling and says the higher amount applies. It converts euro to forint at the MNB rate on the decision day. Lower fixed amounts apply to single breaches. Missing registration data costs up to 2% of the entity's net revenue or HUF 150,000,000, and a missed incident report costs up to HUF 5,000,000. A manager who fails a legal duty risks a fine of up to HUF 15,000,000.