Hungarian Online Store Fined €27,300 for Missing Privacy Notice
An online store operator in Hungary was fined HUF 10,000,000 (~€27,300) by the National Data Protection Authority (NAIH) for failing to publish a compliant privacy notice on its website. This violated core GDPR principles, including transparency, accountability, and the obligation to inform data subjects about how their personal data is processed. Without a clear privacy notice detailing purposes, legal bases, storage periods, and data recipients, customers had no meaningful insight into how their data was being used. This case highlights that even basic legal compliance requirements — such as publishing a privacy notice — can result in significant financial penalties when neglected. Businesses operating online must treat privacy documentation as a fundamental operational requirement, not an afterthought.
Tactical Insight
Immediate actions
- Conduct a rapid audit of all customer-facing web properties to verify a compliant, GDPR-aligned privacy notice is publicly accessible.
- Ensure the privacy notice explicitly covers data processing purposes, legal bases, retention periods, and data recipients as required by GDPR Articles 13 and 14.
Long-term improvements
- Establish a data privacy governance program with assigned ownership for maintaining and reviewing privacy documentation on a regular schedule.
- Integrate privacy notice compliance checks into the launch checklist for any new website, product, or service that processes personal data.
- Conduct annual GDPR compliance reviews with legal or Data Protection Officer (DPO) oversight to catch gaps before regulators do.
Detection & Monitoring measures
- Implement a compliance monitoring calendar with automated reminders to review and update privacy notices whenever data processing activities change.
- Subscribe to DPA guidance and enforcement decision updates to stay informed of evolving regulatory expectations in relevant jurisdictions.