Hungary’s data authority issues specific requirements for breach management and website security

Hungary’s Data Protection Authority (NAIH) recently published a decision based on a detailed review of a website operator’s breach management and security measures, which contains detailed criteria on how data controllers must handle breaches and the technical and organisational measures that must be applied to ensure the security of websites. The case can serve as a lesson and cautionary tale for any company operating a website.

What happened?

Certain admin subpages of the website, intended for administrators only, became visible on search engines, revealing the data of 62 applicants for adult education courses. The breach was caused by a plug-in configuration error. The exposed data included the applicants’ names, email addresses, telephone numbers, motivational videos, motivational letters, and social media accounts. The NAIH issued a warning (without a fine) and instructed the company to publish the NAIH decision on its website homepage for 30 days.

What did the NAIH examine?

Adequacy of breach management: The NAIH found the company’s breach response adequate. The company had a breach management policy and register, a detailed risk analysis, and a commitment to implement additional measures, such as introducing two-factor authentication for administration, reviewing users with elevated privileges, adding security functions to the server environment, and documenting extended testing.

Deficiencies in the existing data security measures

The NAIH also reviewed the company’s data security measures and found them insufficient. The breach could have been avoided with additional steps, such as:

• Testing plug-ins in a separate test environment before use in the live system.
• Regular logging, monitoring, and security audits, including extra checks when new elements are added.
• Proper web server configuration (e.g. disabling directory listings and restricting access).

Takeaways for website operators

The NAIH requires companies to have a breach management policy and register, and to prepare a detailed risk analysis for each incident. They must also use two-factor authentication, manage user privileges, and document testing. For websites, it is essential to configure servers so that data is secure, conduct tests in a separate environment, enable logging and monitoring, and conduct regular security audits and vulnerability checks.

For more information on data protection regulations in Hungary, contact your CMS client partner and these CMS experts.