What must an organisation report if personal data leak in Hungary?

The data protection authority says a controller must report a personal-data incident without undue delay, and if possible within 72 hours of learning of it, unless the incident is unlikely to risk people's rights and freedoms. If the report is later than that, the reasons for the delay must be attached. If the controller does not yet have every fact, it can file in stages and add the rest later.

Continue on Nemzeti Adatvédelmi és Információszabadság Hatóság