Hungary

Section 8(4) requires organisations under Section 1(1)a-c to notify the national cybersecurity authority within 30 days of coming under the Act, survey systems within 90 days and submit an information security policy within 180 days; Section 8(5) requires certain entities to send registration data to SZTFH within 30 days; changes go in within 15 days (s. 8(3)a). Read from the ENISA-hosted Hungarian text, which ends at Section 19.

NAIH's page on data subject rights (GDPR Chapter III) says the controller must act on a request within one month, extendable by two further months for complex or numerous requests with reasons given in the first month; information is free unless requests are unfounded or excessive.

The non-binding Recommendation expects a register of all cloud activities (para. 16), an assessment of whether a use is outsourcing (para. 10), a risk analysis and exit strategy (paras. 17-20), and information to the MNB on cloud activities (para. 29). The text sets no notification deadline.

Section 30 requires executives, employees and assisting family members to make a written report promptly when they find signs of money laundering, terrorist financing or assets from a punishable act. Under Section 32 the service provider may not execute the transaction until the report is forwarded, unless that is impossible or delay would jeopardise monitoring of the beneficiary. Section 31 requires designated persons to forward reports promptly to the financial intelligence unit.