I. Scope of the Cybersecurity Act

With minor differences (e.g., state forestry, certain food processors and distributors), the Cybersecurity Act covers practically the same organizations that were previously covered by the Cybersecurity Certification Act and the Electronic Information Security Act, thus the scope of organizations covered by Hungarian cybersecurity legislation has not fundamentally changed. 

The Cybersecurity Act - in contrast to the provisions of the Cybersecurity Certification Act - partially adopts the jurisdictional provisions of the NIS2. However, the transposition does not fully follow the NIS2 regarding the jurisdictional rules applicable to certain IT service providers (e.g., DNS service providers, cloud computing service providers, data center service providers, content delivery network providers, managed service providers, managed security service providers, providers of online marketplaces, online search engines and social networking services platforms), which in our view may lead to legal interpretation problems in relation to the determination of the place of main establishment. Although this problem could potentially be resolved by the case law of the Court of Justice of the European Union, the position of the Hungarian legislator and the related position of the Hungarian Authority for the Supervision of Regulated Activities (SZTFH) is currently unknown.

II. New provisions of the Cybersecurity Act

An organization operating an electronic information system subject to the Cybersecurity Act that is not registered in Hungary must appoint in writing a representative based in Hungary, who is responsible for the implementation of the provisions of the Cybersecurity Act in accordance with the rules applicable to the head of the organization.

The Cybersecurity Act - modelled on NIS2 - introduces a categorization of organizations subject to Hungarian cybersecurity legislation, according to which the concerned organizations may be classified as essential or important (depending on the criticality of the service they provide for the functioning of the state, society, the economy, and in some cases the size of the organization). According to this categorization, different requirements will apply to the concerned organizations, e.g., important organizations will not be required to classify their systems and the level of fines that can be imposed under NIS2 is also expected to be different.

The Cybersecurity Act also contains new provisions on the qualifications of the person responsible for the security of electronic information systems, as the new Act stipulates that only persons with legal capacity and no criminal record may perform this activity, and in certain cases they must have the necessary education, professional qualifications, accredited international qualifications or professional experience in a field specified in the relevant decree.

If the organization does not have a suitably qualified employee, it should delegate the management of a cybersecurity incident to an organization specifically registered by the SZTFH as authorized to manage cybersecurity incidents.

III. Registration

For the registration of organizations previously subject to the Cybersecurity Certification Act, the Cybersecurity Act provides for a 30-day deadline after starting operations or falling under the scope of the Cybersecurity Act.

According to the Cybersecurity Act, a concerned organization that is listed as a concerned organization in the previous register kept under the Cybersecurity Certification Act on 31 December 2024 is not required to re-register. This is because the SZTFH treats the data of concerned organizations in the register kept under the Cybersecurity Certification Act as part of the register under the Cybersecurity Act. 

IV. Legal consequences

If the concerned organization does not comply with the relevant Hungarian cybersecurity legislation, the SZTFH may, inter alia:

1. Warn the concerned organization to comply with the security requirements and/or relevant rules of procedure.
2. Warn the concerned organization to 
   1. address the security deficiencies identified during an official audit or an external audit required under the Cybersecurity Act, and/or
   2. take the necessary measures to achieve compliance with the relevant safety rules within a specified timeframe.
3. Order the concerned organization to cease the infringing conduct and to desist from repeating it.
4. Assign an information security officer at the expense of the concerned organization.
5. Require the concerned organization to disclose the fact and circumstances of the infringement in a manner determined by the authority, taking into account the rules on data protection and business confidentiality.
6. Require the concerned organization to inform users of its services of the potential threat to them or the likely effects of the preventive measures necessary to avoid such a threat.

In addition to the above, the SZTFH may impose a fine if, despite the measure(s) taken as described above, the concerned organization fails to comply with or observe the security requirements and related rules of procedure, fails to remedy security deficiencies, fails to take the necessary measures to comply, or fails to cease operations. The fine may be repeated in the event of further non-compliance. In the case of an infringement, a fine may also be imposed on the head of the organization, and in the case of a repeated infringement, such imposition is mandatory.

The legislator has not yet specified the amount of the fines that may be imposed, but under NIS 2 the SZTFH will be entitled to impose a maximum fine of

• At least EUR 7 000 000 or 1.4% of the company's total worldwide annual turnover in the previous financial year (whichever is higher) on important organizations.
• At least EUR 10 000 000 or 2% of the company's total worldwide annual turnover in the previous financial year (whichever is higher) on essential organizations;

noting that the legislator may set a higher maximum fine.

The Cybersecurity Act creates a comprehensive cybersecurity framework, but it does not contain all of the rules on cybersecurity. The details (such as the detailed rules on fines and the handling of security incidents) will be set out in government, ministerial and SZTFH presidential decrees issued under the Act.