NAIH (Hungary) - NAIH-450-7-2026
Hungary's NAIH fines an online store operator HUF 15M for GDPR transparency violations.
Hungary's National Data Protection Authority (NAIH) has fined an online store operator HUF 15,000,000 (€41,500) for multiple GDPR violations. The investigation, spanning from January 2020 to November 2025, found the company guilty of failing to provide clear, transparent, and intelligible information to customers regarding data processing purposes, legal bases, and retention periods. The authority also cited conflicting information on data transfers to third countries.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NAIH?
Get an email when a new story names NAIH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn Hungarian online store accumulated GDPR violations over nearly six years by failing to clearly communicate to customers how their personal data was collected, processed, and retained. The company also provided conflicting information about transfers of personal data to third countries, compounding the transparency failures. This case illustrates that privacy compliance is not a one-time checkbox but requires ongoing governance, review, and accurate documentation. Regulators will look back across extended timeframes, meaning even legacy policy failures carry significant financial and reputational risk.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.