1. Submissions relating to data protection

If you believe that a data protection infringement warranting an investigation has occurred, or that the processing of your personal data infringes the provisions of the GDPR or the provisions of Directive (EU) 2016/680 of the European Parliament and of the Council of 27 April 2016 on data processing for law enforcement purposes (hereinafter: Law Enforcement Directive), you may initiate proceedings with the National Authority for Data Protection and Freedom of Information (hereinafter: the Authority), provided that you submit the relevant evidence at the same time in a clearly identified manner.

The Authority’s official proceedings are conducted in Hungarian. An exception to this are the enquiries and submissions listed on page 3 - enquiries that may be submitted by email as well -; in such cases, it is recommended that correspondence be conducted in English to ensure effective and smooth communication.

The Authority draws your attention to the fact that, in the event of a suspected data protection breach, an authority procedure for data protection may be initiated by the data subject, or an investigation may be initiated by an identified complainant or a notifier of public concern. Data protection authority procedures upon request may only be initiated by the data subject (a legal representative / person authorised by them and acting on their behalf).

In addition to the provisions of the GDPR or the Law Enforcement Directive, the rules set out in Act CL of 2016 on General Public Administration Procedures shall apply to authority procedures for data protection, subject to the exceptions specified in Act CXII of 2011 on the Right of Informational Self-Determination and on Freedom of Information (hereinafter: Privacy Act). The investigation procedure does not constitute an authority procedure; during such a procedure, the Authority acts exclusively in accordance with the relevant provisions of the Privacy Act.

The administrative time limit for authority procedures for data protection is 150 days; however, this period does not include the time required to clarify the facts of the case, the duration of the suspension or stay of the proceedings, and the duration of the client’s omission or delay. In the case of an investigation procedure, the Authority has two months to assess whether a data protection infringement has occurred; if such an infringement is established, the Authority may take measures or initiate an authority procedure.

Whether you wish to initiate an investigation or authority proceedings, it is important that you clearly indicate your intention to initiate the proceedings. Name the alleged controller, describe the conduct or situation believed to be in violation of the law and, in order to substantiate your claim, provide the Authority with all the evidence necessary for the conduct of the proceedings and may be relevant to the case:

• If you have contacted the alleged controller in writing (exercise of data subject rights under Chapter III of the GDPR), you must also submit all correspondence with the controller in such a way that the identity of the sender and the recipient, as well as the date of dispatch or receipt, can be clearly established; furthermore, if available, you must also submit any acknowledgement of receipt confirming that the correspondence was received.

• In both types of procedure, it is necessary to clearly identify the controller and provide all their known contact details, given, on the one hand, that the Authority cannot, within the framework of an investigation procedure, take action against an unknown controller or one whose whereabouts are unknown, conduct the investigation procedure, or, where appropriate, order the controller to remedy the infringement, and, on the other hand, pursuant to Section 60(5)(c) of the Privacy Act, the request for authority proceedings must contain the information available to the applicant that is necessary to identify the controller or the processor alleged to have committed the infringement.

• Any identified person may initiate an investigation procedure upon complaint. If the complainant/notifier refuses to be identified, fails to respond to the Authority’s request to do so, or if an anonymous complaint is received by the Authority, or if it can be established that the complaint is solely in the public interest without any personal involvement, the Authority may consider whether to initiate proceedings ex officio in relation to the submission. In such cases, the complainant shall not be regarded as an identified person during the proceedings, and their statements shall not be regarded as a statement of the data subject. In the case of a complaint regarding an alleged violation of an individual's rights, the notifier must also state whether their identity may be disclosed to the controller. Pursuant to Section 52(3) of the Privacy Act, no one shall suffer prejudice on account of a notification submitted to the Authority, and the Authority may only disclose the notifier’s identity to the controller if the investigation cannot be carried out otherwise. If so requested by the notifier, the Authority shall not reveal the notifier’s identity, even if the inquiry cannot be carried out otherwise. If the notifier does not consent to the disclosure of their identity, the Authority can only investigate the contested data processing activity in general terms, but cannot initiate proceedings specifically in relation to an individual infringement of rights concerning the processing of the complainant’s personal data.

• In accordance with Article 77(1) of the GDPR, an authority procedure for data protection may only be initiated by the data subject (or a legal representative / person authorised by them and acting on their behalf). With regards to an authority procedure for data protection, Section 28(1) of the General Public Administration Procedures Act provides for the confidential processing of data. Accordingly, „the authority shall, upon application or ex officio, order the confidential processing of the natural identification data and address of the party and other participants in the procedure if a) they may suffer seriously detrimental consequences due to their participation in the procedure, or b) the confidential processing of data of the party or other participant in the procedure was ordered in another court or authority procedure arising from the same factual situation that was closed with administrative finality or with final and binding effect, or that is concurrently pending and known to the authority.”

The Authority draws your attention to the fact that proceedings may only be initiated in an identifiable manner, using one of the following methods. A standard email sent to the Authority’s email address^[1] is not acceptable, as in the case of such emails the Authority cannot verify beyond all doubt the identity of the sender, and as a digital service provider it may only accept submissions relating to proceedings in accordance with the following methods:

• Electronically, in accordance with Act CIII of 2023 on the Digital State and on the Provisions for Supplying Digital Services (hereinafter: Dáptv.)^[2] (using an active digital citizenship user profile via the e-Papír service^[3]);
• In writing, by postal mail, in the form of a private document with full probative value^[4] containing your personal identification data (surname and first name; birth family name and first name; mother’s birth family name and first name; place of birth; date of birth), sent to the Authority’s postal address (1363 Budapest, PO Box 9);
• In person, during the Authority’s office hours, without a prior appointment, following verification of your identity and, where necessary for the proceedings and not already included in the documents submitted, following the recording of your personal identification details.

Exceptions to the above are enquiries received by simple email concerning data processing in the following systems and submissions on the following subjects:

• Schengen Information System (SIS),
• Entry/Exit System (EES), and
• Visa Information System (VIS), and
• Customs Information System (CIS),
• submissions relating to reporting a personal data breach, consultations and DPO registrations.

Under the one-stop-shop procedure, a foreign national may also initiate a procedure with Hungarian relevance at their own national authority, to which the legislation of their own Member State applies.

2. Submissions concerning freedom of information

Anyone may apply to the Authority for the initiation of an investigation by making a notification claiming that an infringement has occurred relating to the exercise of the right of access to data of public interest or data accessible on public interest grounds, or there is an imminent threat of such an infringement.

Proceedings relating to an individual infringement of rights – in connection with a request for data of public interest – cannot be initiated by email. A submission sent to the Authority’s email address via a simple email not bearing a qualified electronic signature shall not be regarded as a document submitted via a secure electronic communication channel specified in the information published by the Authority and capable of producing legal effects. The Authority therefore regards such submissions as not having been submitted and will not register them.

Detailed information on the appropriate methods for submitting a complaint alleging an individual infringement of the freedom of information – that is, the right to access data of public interest or data accessible on public interest grounds – and on the types of proceedings conducted by the Authority can be found at https://naih.hu/hatosag-eljarasai and https://naih.hu/kozerdeku-vagy-kozerdekbol-nyilvanos-adatok-megismeresevel-kapcsolatosan-fordulok-a-hatosaghoz/hatosag-vizsgalata.

Any infringement concerning freedom of information, or any imminent threat thereof, reported as a general complaint in the public interest (not relating to an individual case), may be submitted to Ez az e-mail-cím a szpemrobotok elleni védelem alatt áll. Megtekintéséhez engedélyeznie kell a JavaScript használatát.. On the basis of the complaint, the Authority will decide ex officio whether to initiate proceedings or to refrain from doing so.

With regard to an infringement or the threat thereof, a submission containing only general statements alleging an infringement is manifestly unfounded. In order for the Authority to investigate the matters, the complainant must provide the Authority with all relevant evidence supporting the essential facts relating to the complaint; thus, in cases concerning freedom of information, this includes both the data request submitted and the response received to it.

Submissions objecting to electronic publication (the websites of bodies performing public functions, or their general publication practices) must also be submitted to the Authority in an identifiable form in order to initiate a freedom of information investigation procedure. In this case, there is no need to disclose the complainant’s identity to the organisation under investigation.

Requests for data of public interest concerning the Authority itself may, of course, also be submitted by simple email, provided the applicant’s name and contact details are included.

Dated at Budapest on 10 November 2026.

^[1] Email address: Ez az e-mail-cím a szpemrobotok elleni védelem alatt áll. Megtekintéséhez engedélyeznie kell a JavaScript használatát.

^[2] Dáptv. “Section 46(1) Electronic identification services provided on a mandatory basis by the Government:

...

b) a client gateway providing enhanced two-factor authentication. ...

(4) Natural person users listed in the central immigration register or in the register of foreign nationals relying upon electronic administration services may make use of the identification service referred to in paragraph (1)(b).”

^[3] https://naih.hu/online-ugyinditas/381-vizsgalati-eljaras-kezdemenyezese-adatvedelmi-ugyben-gdpr

^[4] Section 325 of the Code of Civil Procedure