VPNs with servers in Hungary

Subscriber details are kept for one year after the contract ends, the other data for one year after they arise, and data on unsuccessful calls for six months (section 159/A(3)). A provider may not store the data in, or entrust them to a processor in, a country outside the European Economic Area (section 159/A(5)). Whether a VPN operator is a provider within section 159/A is not established.

In Decision 15/2022 (VII. 14.) AB the Constitutional Court found that Parliament had infringed the Fundamental Law by omission as to sections 157(2), (3), (10) and 159/A, set a deadline of 31 December 2022, and rejected the petition to annul section 159/A, holding the periods of one year and six months proportionate in themselves. As of 3 November 2026, section 159/A(3) still reads that way in the consolidated text.

Under sections 36/G–36/K of Act XXXIV of 1991 on the organisation of gambling, the gambling supervisory authority (SZTFH) orders that electronic data offering or advertising prohibited gambling be made inaccessible.

The order binds every electronic communications provider, the media authority NMHH organises its execution, and a provider that fails to comply may be fined HUF 1–5 million, repeatedly while the failure lasts. Since 1 July 2023 payment service providers have also had to stop card transactions to unlicensed foreign gambling sites.

The Criminal Code punishes defamation (rágalmazás, section 226), the assertion or spread of a fact capable of damaging someone’s reputation, with up to one year’s imprisonment, or up to two years where it is done before a large public or causes significant harm to an interest.

Incitement to violence or hatred before a large public against a national, ethnic, racial or religious group, or against other groups of the population, is a felony punishable by up to three years (section 332).

Section 332/A punishes, with up to one year, publicly expressing over an electronic communications network an intention or wish that an identifiable person suffer a violent, death-causing or especially cruel act. For attribution, section 159/A(1)(j) requires providers to retain the data needed to follow any change of subscribers’ technical identifiers, namely the IP address and port number.

Under Act CXXV of 1995 on the National Security Services, secret information-gathering for certain tasks is authorised by a judge designated by the president of the Budapest-Capital Regional Court, and for the remaining tasks by the minister responsible for justice (section 58). The authoriser decides within 72 hours, with no appeal, and authorises for up to 90 days, extendable by a further 90.

In Szabó and Vissy v. Hungary (12 January 2016) the European Court of Human Rights found unanimously a violation of Article 8: the anti-terrorism surveillance rules lacked adequate safeguards, and there was no judicial supervision. The order of the rows is the security score, and a server’s location is not a recommendation.