Hungarian Online Store Fined €41,500 for GDPR Transparency Failures
An online store operator in Hungary was fined HUF 15,000,000 (€41,500) by the National Data Protection Authority (NAIH) for failing to provide clear, concise, and intelligible information about its data processing activities, including inadequate disclosures around third-country data transfers. Under GDPR Articles 13 and 14, organizations are legally obligated to inform individuals about the purposes and legal bases for processing their personal data in a transparent manner. This case highlights that GDPR compliance is not just about technical safeguards — it equally demands clear, accessible, and accurate privacy documentation. Failure to maintain compliant privacy notices exposes organizations to significant financial penalties and reputational harm, even without a data breach occurring.
Tactical Insight
Immediate actions
- Conduct a full audit of all public-facing privacy notices, terms and conditions, and cookie policies to ensure they meet GDPR transparency requirements.
- Identify and explicitly document all third-country data transfers, including the legal transfer mechanisms used (e.g., SCCs, adequacy decisions).
Long-term improvements
- Establish a recurring privacy notice review cycle (at least annually or upon any change in data processing activities) involving legal and compliance teams.
- Appoint or engage a qualified Data Protection Officer (DPO) or privacy counsel to oversee ongoing GDPR compliance obligations.
- Build a Data Processing Register (Article 30 record) that maps all processing activities, purposes, legal bases, and data flows to third parties or countries.
Training & Awareness
- Train marketing, legal, and product teams on GDPR transparency obligations so privacy requirements are embedded into website and product updates.
- Implement a review gate in the website publication workflow that requires compliance sign-off before changes to data processing practices go live.