NAIH (Hungary) - NAIH-11443-3/2026
NAIH fines an online store HUF 2,000,000 for GDPR violations regarding data processing information.
Hungary's National Data Protection and Freedom of Information Authority (NAIH) has fined an online store HUF 2,000,000 (approximately €5,500) for failing to provide customers with clear, transparent, and intelligible information about their personal data processing. The investigation, which began in April 2025, found violations related to cookies, registration, billing, and data transfers. The company's privacy notice, unchanged since 2018, was deemed confusing, incomplete, and lacking specific details on legal bases and data storage periods.
AI summary of the linked source. Not reviewed by an editor. How this works
Run NAIH?
Get an email when a new story names NAIH, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAn online store in Hungary was fined €5,500 after NAIH found its privacy notice — unchanged since 2018 — failed to provide clear, complete, and intelligible information about how customer data was processed. The violations spanned cookies, registration, billing, and third-party data transfers, all of which lacked specified legal bases and data retention periods. This case highlights that privacy documentation is not a one-time exercise; it must be actively maintained to reflect current data practices and evolving regulatory standards. Failing to update privacy notices exposes organizations to regulatory penalties and erodes user trust. GDPR compliance requires ongoing governance, not just initial implementation.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.