NAIH

in English: Hungarian National Authority for Data Protection and Freedom of Information

basicwidespread

The NAIH is the Hungarian data protection authority. It supervises whether companies, public bodies, and AI systems handle your personal data lawfully and can impose fines. It also ensures you can access public-interest data.

In plain terms

The NAIH is to personal data what traffic police are to roads. It does not write the rules, but it checks compliance and punishes those who break them.

Most of the rules originate from the EU's General Data Protection Regulation (GDPR) and the Hungarian Information Act (Infotv.). The authority is independent: neither the government nor any other body can instruct it on how to decide a case.

It has two tasks. One is the protection of personal data, meaning that no more information than permitted is collected, stored, or analyzed about you. The other is freedom of information, meaning you can access public interest data, such as how public funds are spent.

Because of AI, its work is becoming increasingly important. If an algorithm analyzes your voice, face, purchases, or CV, that counts as processing personal data. The same applies when an agent handles affairs on your behalf while accessing your data. These cases may all fall under the remit of the Hungarian National Authority for Data Protection and Freedom of Information (NAIH).

How it works

If you feel your data is being misused, you should first contact the data controller (the company or authority): you can request information, correction, or deletion.
If it does not respond or the response is unsatisfactory, you can file a free report or complaint with the NAIH (National Authority for Data Protection and Freedom of Information). The authority can also initiate proceedings on its own initiative.
The authority investigates the case: it requests documents, interviews the company, and inspects the site if necessary. For AI systems, it also examines what data the algorithm works with and whether you received the mandatory information about it.
If it finds a violation, it can issue a warning, order data deletion, prohibit data processing, and impose a fine. Under the GDPR, the upper limit for fines is 20 million euros or 4 percent of the company's total annual global turnover, whichever is higher.
The decision can be challenged in court. If a company processes data in several EU countries and its European headquarters is in another member state, the case is usually led by the authority of that country. You can still file a complaint with the NAIH, the Hungarian data protection authority, which cooperates with the authority there.

An everyday example

You call your bank's customer service, and at the beginning of the call you are told that the conversation is being recorded. However, you are not told that an AI also analyzes the recording and, for example, measures from your voice how angry or dissatisfied you are. In 2022, the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) imposed a fine of HUF 250 million on a Hungarian bank in such a case.

Who is affected

everyoneAnyone can contact the authority for free if they believe a company, office, or AI system is handling their data unlawfully.

entrepreneur, executiveIf your company handles data of clients or employees, or implements AI, the NAIH may inspect it and impose significant fines.

developerIf you are building an AI system or agent that works with personal data, you must incorporate data protection requirements already at the design stage, as the authority can hold you accountable. → Code

employeeIf your workplace monitors your work with cameras, software, or AI, you can ask the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) to examine whether this is lawful. → Work & HR

A common misconception

MythThe Hungarian data protection authority (NAIH) awards compensation to those whose data has been misused.

In realityThe authority establishes the violation and may fine the data controller, but the fine does not go to the complainant. Compensation or damages can only be claimed in court, in a separate lawsuit.

Limits and risks

The procedure can take months. In urgent cases, such as harassment or fraud, it is advisable to also turn to the police or the court.
Cases involving major tech companies based abroad are often led by the authority of another country, so the scope for action of the Hungarian data protection authority (NAIH) is limited.
In an AI system, the NAIH examines how personal data is handled. It generally does not assess whether the system is otherwise secure, accurate, or fair.
The GDPR does not apply to private, home data processing (for example, your family photo album or your own phone book), and the NAIH does not act in such matters.

Similar, but not the same

Data Protection Officer (DPO) – A DPO is responsible for data protection within a company or office, while the NAIH is an external, independent state supervisory authority.
Artificial Intelligence Supervisory Authority – Market surveillance under the EU AI Act mainly checks whether AI systems are safe and comply with the regulation. Hungary's data protection authority (NAIH) checks whether personal data are processed lawfully. In certain sensitive areas, such as law enforcement facial recognition, the regulation can also give the data protection authority a market surveillance role.
Commissioner for Fundamental Rights (ombudsman) – The ombudsman usually investigates fundamental rights violations and makes recommendations, while the NAIH acts specifically in data matters and can issue binding decisions and fines.

Related concepts

Broader

Data protection, Supervisory Authority, AI regulation

Narrower

data protection fine, data privacy incident, Data Protection Impact Assessment

On the edge

GDPR, EU AI-rendelet (AI Act), Personal data, European Data Protection Board, Freedom of Information

A brief history

The NAIH began operations on January 1, 2012, based on Act CXII of 2011 on the right to informational self-determination and freedom of information, replacing the former data protection ombudsman institution. Since May 25, 2018, it has been the Hungarian supervisory authority for the GDPR.

Where things stand

The NAIH (the Hungarian National Authority for Data Protection and Freedom of Information) is a long-established authority that, by the end of 2026, regularly deals with AI-related data processing. As the EU AI Act is applied gradually, its role is growing further, because most AI systems work with personal data.

Status: 2026 November

In the news

Appears in 15 Agent Age stories; the curve shows weekly occurrence in the news magazine.

Hamburg data protection authority drafts letters with an OpenAI model as complaints rise 62%Nov 8, 2026 · Jog
EDPB publishes €824.99 million GDPR fine against Uber; Noyb cites €2 billion in finesOct 12, 2026 · Jog
Who is liable when legal AI shares client data? Guernsey's data watchdog issues warningOct 12, 2026 · Jog
Italian regulator fines Wind Tre €16.7 million over unlawful telemarketingOct 12, 2026 · Jog
Hungarian data protection authority NAIH imposes record fine over AI analysis of customer service recordingsSep 30, 2026 · Jog
Hungarian lawyer warns what data not to enter into AI chatbotsSep 28, 2026 · Jog
Irish data protection authority publishes AI reportSep 24, 2026 · Jog
Spanish data protection authority receives first data breach report linked to an AI agentSep 15, 2026 · Jog

Also known as

NAIH · National Authority for Data Protection and Freedom of Information · data protection authority · Hungarian Data Protection Authority · Hungarian National Authority for Data Protection and Freedom of Information · Hungarian Data Protection Authority · Hungarian DPA

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.