NAIH (Hungary) - NAIH-450-7-2026
Hungary's NAIH fines an online store operator HUF 15M for GDPR violations.
Hungary's National Data Protection Authority (NAIH) has fined an online store operator HUF 15,000,000 (approximately €41,500) for multiple GDPR violations. The investigation, spanning from January 2020 to November 2025, found that the controller failed to provide clear, transparent, and intelligible information regarding data processing purposes, legal bases, and retention periods. Additionally, contradictory information on the website regarding data transfers to the United States was identified.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NAIH?
Get an email when a new story names NAIH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn online store operator in Hungary was fined HUF 15,000,000 (~€41,500) after a multi-year NAIH investigation revealed systemic failures in GDPR transparency obligations. The controller failed to clearly communicate data processing purposes, legal bases, and retention periods to users — foundational requirements under GDPR Articles 13 and 14. Contradictory information about U.S. data transfers further compounded the violations, suggesting a lack of internal governance over privacy documentation. This case demonstrates that privacy notices are not a one-time exercise; they require ongoing review and accuracy to remain legally compliant. Regulators are increasingly scrutinizing the quality and consistency of privacy disclosures, not just whether they exist.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.