[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPrN5zEk4kncQLBYPC4HRpnkrMNCxZE3PkxN7m_LD-XM":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":49},"2b82b5b1-7740-4816-be78-92f316880eae","hungarian-online-store-fined-41500-for-gdpr-transparency-failures-1785925312590","0aa1486f-b625-4da7-b6b3-46b3c524fc05","Hungarian Online Store Fined €41,500 for GDPR Transparency Failures","An online store operator in Hungary was fined HUF 15,000,000 (€41,500) by the National Data Protection Authority (NAIH) for failing to provide clear, concise, and intelligible information about its data processing activities, including inadequate disclosures around third-country data transfers. Under GDPR Articles 13 and 14, organizations are legally obligated to inform individuals about the purposes and legal bases for processing their personal data in a transparent manner. This case highlights that GDPR compliance is not just about technical safeguards — it equally demands clear, accessible, and accurate privacy documentation. Failure to maintain compliant privacy notices exposes organizations to significant financial penalties and reputational harm, even without a data breach occurring.","**Immediate actions:**\n- Conduct a full audit of all public-facing privacy notices, terms and conditions, and cookie policies to ensure they meet GDPR transparency requirements.\n- Identify and explicitly document all third-country data transfers, including the legal transfer mechanisms used (e.g., SCCs, adequacy decisions).\n\n**Long-term improvements:**\n- Establish a recurring privacy notice review cycle (at least annually or upon any change in data processing activities) involving legal and compliance teams.\n- Appoint or engage a qualified Data Protection Officer (DPO) or privacy counsel to oversee ongoing GDPR compliance obligations.\n- Build a Data Processing Register (Article 30 record) that maps all processing activities, purposes, legal bases, and data flows to third parties or countries.\n\n**Training & Awareness:**\n- Train marketing, legal, and product teams on GDPR transparency obligations so privacy requirements are embedded into website and product updates.\n- Implement a review gate in the website publication workflow that requires compliance sign-off before changes to data processing practices go live.",[12,13,14,15,16,17,18,19,20],"GDPR Article 5(1)(a) – Principle of Transparency","GDPR Article 13 – Information to be provided where personal data are collected from the data subject","GDPR Article 14 – Information to be provided where personal data have not been obtained from the data subject","GDPR Article 44-49 – Transfers of personal data to third countries","GDPR Article 30 – Records of processing activities","NIST Privacy Framework PR.PO-P1 – Policies and procedures for privacy","CIS Control 3 – Data Protection","ISO\u002FIEC 27701:2019 – Privacy Information Management","ITIL Service Design – Compliance and Legal Requirements Management",{},"published","2026-08-05T10:21:52.694534+00:00","2026-08-05T10:21:52.189+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fgdprhub.eu\u002Findex.php?title=NAIH_(Hungary)_-_NAIH-450-7-2026&diff=52621&oldid=52612","naih-hungary-naih-450-7-2026-6099b2","NAIH (Hungary) - NAIH-450-7-2026",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":37,"name":38,"slug":39,"description":40,"color":41},"c0dcc566-3654-4d70-8ede-262a198e732f","Regulatory Compliance","regulatory-compliance","GDPR, NIS2, DORA, sector-specific violations","#ec4899",{"id":43,"name":44,"slug":45,"description":46,"color":47},"c8b843a5-d5a7-41d1-8d3b-cabded09d2ef","Data Protection","data-protection","Unencrypted data, missing DLP, poor classification","#3b82f6",[],[50],{"slug":51,"name":52,"problem":53},"compliance-automation","Compliance automation (GRC)","Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit."]