Hungary Recording Laws: Consent, Penalties, and 2025 AI Rules

Quick Answer: Is Hungary All-Party Consent?

Yes. Hungary is an all-party consent country for audio and video recordings of private conversations. Every person taking part in a conversation must be informed that a recording is being made and must consent before recording begins. Silence or continued participation does not satisfy the consent requirement.

Three separate legal frameworks enforce this standard. The Criminal Code (Act C of 2012, Büntető Törvénykönyv, or Btk.) makes unauthorized recording a criminal offense under Btk. § 422. The Civil Code (Act V of 2013, Polgári Törvénykönyv, or Ptk.) classifies voice recordings as personality rights under Art. 2:48. And the EU General Data Protection Regulation, enforced in Hungary by the National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), treats voice recordings as personal data requiring a lawful processing basis.

These frameworks are independent. A single unauthorized recording can trigger criminal prosecution, a civil lawsuit, and an administrative fine from NAIH all at once. There is no hierarchy between them. Each track has its own enforcement body and its own remedies.

Btk. § 422 and § 219: The Criminal Framework

Hungary's Criminal Code provides the primary criminal prohibition on unauthorized recordings. Two sections work together: § 422 on illegal data acquisition and § 219 on misuse of personal data.

Section 422: Tiltott Adatszerzés (Illegal Data Acquisition)

Btk. § 422(1) makes it a criminal offense to unlawfully acquire personal data, private secrets, business secrets, or trade secrets through any of the following methods:

• Secretly searching another person's home or premises
• Observing or recording activities using technical devices inside another person's residence
• Opening sealed correspondence and recording its contents
• Intercepting data transmitted via electronic communications networks or information systems

The core concept is secrecy combined with technical means. A conversation recorded by a smartphone hidden in a pocket qualifies. So does a voice-over-IP call intercepted at the network level. So does a dictaphone placed in a conference room without participants' knowledge.

Basic penalty: Up to 3 years imprisonment.

Btk. § 422(4) raises the penalty to 1 to 5 years imprisonment when the offense is committed:

• While impersonating an official or under the pretext of official authority
• On a commercial or business scale (üzletszerűen)
• Through criminal conspiracy
• In a manner that causes significant harm to the victim

The aggravated form is classified as a felony (bűntett) under the Hungarian system. A felony conviction creates a permanent criminal record and can result in loss of professional licenses, disqualification from public office, and bars on certain employment categories.

Btk. § 422(3) separately criminalizes disclosing or using data obtained through illegal recording. Passing along a recording you know was illegally made carries the same criminal exposure as making the recording yourself. This provision reaches recipients who share unlawfully obtained recordings on social media or submit them to journalists.

Section 219: Személyes Adattal Visszaélés (Misuse of Personal Data)

Btk. § 219 addresses unauthorized processing of personal data in violation of data protection law. The offense requires either a profit-seeking motive or conduct that causes significant harm, and it demands intentional conduct throughout.

The penalties scale with the type of data:

• Ordinary personal data processed without authorization or contrary to its stated purpose: up to 1 year imprisonment
• Special categories of personal data (which include biometric data; voice patterns qualify as biometric data under GDPR Art. 9 when processed for identification purposes): up to 2 years imprisonment
• Official abusing public authority in the commission of the offense: up to 3 years imprisonment, classified as a felony

Btk. §§ 219 and 422 are not mutually exclusive. Prosecutors charge both when the facts support it. A call center employee who secretly records customer calls for personal financial gain could face charges under both provisions simultaneously.

Section 224: Levéltitok Megsértése (Breach of Correspondence Secrecy)

Btk. § 224 criminalizes destroying, opening, or intercepting sealed communications, including electronic messages and private correspondence. The base offense is a misdemeanor.

Penalties escalate based on circumstances:

• Use of official position or public authority: up to 1 year imprisonment
• Conduct causing significant harm: up to 2 years imprisonment
• Official causing significant harm through abuse of position: up to 3 years imprisonment

Section 224 offenses are prosecuted through private complaint (magánindítványra büntethető). The victim must file a complaint within 30 days of identifying the offender. When the offense is already connected to a state prosecution, public prosecutors may proceed without a private complaint.

Section 223: Magántitok Megsértése (Breach of Private Secrets)

Btk. § 223 targets professionals who disclose confidential information obtained through their work: doctors, lawyers, psychologists, public notaries, and public officials who reveal private information without justification.

Base penalty: short-term detention. When significant harm results, the maximum rises to 1 year imprisonment. Prosecution requires a private complaint.

Btk. § 226: Image-Based Offenses and False Recordings

Btk. §§ 226/A and 226/B target a distinct but related category: the creation and distribution of manipulated recordings intended to damage reputation. These provisions have become increasingly relevant as AI-generated synthetic media has proliferated.

Section 226/A: Creating False Recordings

Btk. § 226/A makes it a criminal offense to create a false or falsified audio or video recording of a person with the purpose of damaging their reputation. The provision covers any manipulated recording, not just digitally generated content.

Penalty: Up to 2 years imprisonment (misdemeanor classification).

Section 226/B: Distributing False Recordings

Btk. § 226/B covers making a false or manipulated recording accessible to the public.

Basic penalty: Up to 2 years imprisonment. When the offense is committed with great publicity or causes significant harm, the penalty rises to up to 3 years imprisonment, reclassified as a felony.

The great publicity aggravation captures distribution via social media platforms, television broadcasts, or viral sharing. A manipulated audio clip shared to tens of thousands of followers would typically qualify.

These provisions operate independently of Btk. § 422. You can violate § 226/B by distributing a deepfake of someone even if you never personally recorded that person. The crime is in the fabrication and circulation of false content, not in any underlying surveillance act.

Civil Code Art. 2:48: Personality Rights and Voice

Hungary's Civil Code provides a parallel civil law remedy that operates entirely independently of criminal prosecution. Under the Ptk., voice and image recordings are classified as personality rights, placed in the same protected category as life, bodily integrity, reputation, and personal freedom.

Article 2:42: General Personality Rights Framework

Art. 2:42 establishes that every person has the right to exercise their personality rights freely. The enumerated protected interests include private life, family life, good reputation, and the right to one's own voice and image. This baseline provision means that an unauthorized recording is not merely a data protection issue. It is an attack on a fundamental civil right.

Article 2:48: Right to Voice and Image Recordings

Art. 2:48 sets out a two-step consent process that governs all recordings in Hungary:

Step 1: The consent of the person concerned is required before making any recording of their voice or image.

Step 2: Separate consent is required before using or distributing that recording in any context.

Permission to record does not automatically grant permission to use. A participant who agrees to be recorded in a business meeting retains full rights to refuse consent for that recording to be shared with third parties, uploaded online, or used in legal proceedings. Both steps require independent, informed consent.

Consent under Art. 2:48 can be given orally, in writing, or through conduct that clearly indicates agreement. Implied consent is interpreted narrowly by Hungarian courts. The circumstances must make it objectively apparent that the person understood they were being recorded and affirmatively accepted it.

Art. 2:48 also contains the public event exception. Recordings of crowds or appearances at public events do not require the individual consent of each person captured. This covers general documentation of demonstrations, parades, concerts, and political rallies. The exception applies to the event as a whole; singling out a specific individual for targeted recording at a public event brings that recording back within the consent framework.

Article 2:52: Grievance Awards (Sérelemdíj)

When a personality rights violation is established, Art. 2:52 provides for sérelemdíj: non-pecuniary compensation with a critical feature. The claimant does not need to prove actual financial harm. The establishment of the violation itself triggers the right to compensation.

Courts set the amount based on the severity of the infringement, whether the conduct was repeated, the degree of fault, and the broader impact on the claimant's social relationships and standing. A person whose private phone call was secretly recorded and shared has a viable civil claim even if no financial loss followed.

GDPR, the Info Act, and NAIH Enforcement

As an EU member state, Hungary applies the General Data Protection Regulation to voice recordings. Any recording of a private conversation captures personal data. Any system that processes, stores, analyzes, or transmits those recordings is subject to the full GDPR framework.

Info Act: Act CXII of 2011

Hungary's domestic data protection law, Act CXII of 2011 on Informational Self-Determination and Freedom of Information, implemented EU data protection principles before GDPR and remains in force alongside it. When GDPR and the Info Act conflict, GDPR takes precedence. The Info Act fills gaps in areas where GDPR grants member state discretion.

GDPR Article 6: Lawful Basis for Recording

Every recording of a private conversation requires a lawful basis under GDPR Art. 6. For most private recordings in Hungary, the only viable basis is consent under Art. 6(1)(a). That consent must be freely given, specific to the recording purpose, informed, and unambiguous. Silence or inaction does not count.

Legitimate interest under Art. 6(1)(f) is available for organizational recording, but NAIH applies strict scrutiny. Any organization relying on legitimate interest must prepare a documented balancing test before recording begins. The NAIH has penalized organizations that invoked legitimate interest without conducting this assessment.

For AI-powered voice analysis, including emotion detection, keyword extraction, or sentiment scoring of recorded calls, the NAIH has ruled that only freely given informed consent qualifies as a lawful basis. Legitimate interest is insufficient for secondary AI processing of voice recordings.

NAIH Transparency Requirements for Recorded Calls

At the start of every recorded call, NAIH requires data controllers to disclose:

• That the conversation is being recorded
• The purpose of the recording
• The legal basis for processing
• The identity of the data controller
• How long the recording will be retained
• The data subject's rights, including access and erasure

A generic statement that "this call may be recorded for quality assurance" does not meet the NAIH standard. The disclosure must be substantive enough for the caller to make an informed decision about whether to continue.

NAIH Enforcement: Major Cases and 2025 Priorities

The NAIH has demonstrated consistent willingness to impose substantial penalties in recording-related cases.

Budapest Bank (2022): The NAIH's largest recorded fine, HUF 250 million (approximately EUR 653,000), was imposed on Budapest Bank for using AI to analyze customer service call recordings. The AI system assessed callers' emotional states and extracted keywords. The bank's privacy notice disclosed only "quality assurance and complaint prevention" as processing purposes, with no mention of AI voice analysis. The bank also improperly relied on legitimate interest as the legal basis for the AI processing rather than obtaining separate consent.

House Installation Company: A smaller company was fined HUF 300,000 (approximately EUR 744) for recording a customer phone call without any prior notice, violating transparency, data minimization, and purpose limitation obligations simultaneously.

Employer Surveillance (2024): An employer received a HUF 15 million fine for failing to meet transparency obligations regarding workplace surveillance cameras and for conducting monitoring disproportionate to the stated purpose.

Total 2024 Fines: The NAIH imposed approximately HUF 335 million in total fines across cases involving AI processing, data breaches, and unlawful surveillance during 2024.

2025 Enforcement Priorities: The NAIH is participating in the European Data Protection Board's 2025 coordinated enforcement action focusing on data subjects' right to erasure. CCTV compliance and proportionality in workplace surveillance remain NAIH priorities. The NAIH president has also stated that improper data processing by political organizations will receive continued attention.

The maximum administrative penalty under GDPR: up to EUR 20 million or 4% of worldwide annual turnover, whichever is higher, for the most serious violations.

Data Subject Rights for Recordings

GDPR grants extensive rights to persons whose voices are recorded:

Right of access (Art. 15): Data controllers must enable subjects to listen to their recording and obtain a copy. When a recording involves multiple participants, each person is an independent data subject with their own right of access.

Right to erasure (Art. 17): Data subjects may request deletion of their recordings. Controllers must honor valid erasure requests within 30 days. The NAIH's 2025 enforcement focus specifically covers how organizations handle erasure requests in practice.

Right to restriction (Art. 18): Where accuracy or lawfulness of processing is contested, data subjects may request that processing be suspended pending resolution.

The EU AI Act: Hungary's 2025 Conflict

The EU AI Act entered into force in August 2024, with prohibitions on unacceptable-risk AI systems becoming enforceable in February 2025. Hungary's legislative response has created a significant compliance tension within the EU framework.

What the AI Act Prohibits and Requires

The AI Act prohibits real-time remote biometric identification of individuals in public spaces by law enforcement except in specified narrow circumstances. Post-hoc facial recognition from stored material is classified as high-risk rather than prohibited, with strict requirements applying from August 2026.

The AI Act also requires that AI systems generating synthetic audio, video, or image content disclose that the content is artificially generated. This transparency obligation intersects directly with Hungary's existing Btk. §§ 226/A and 226/B criminal provisions on false recordings.

Hungary's March 2025 Biometric Surveillance Law

In March 2025, the Hungarian Parliament passed three amendments within 24 hours, without public debate. Entering into force on 15 April 2025, the amendments dramatically expanded police authority to use facial recognition technology in infraction procedures.

Before the amendments, facial recognition was permitted only for infractions punishable by custodial sentences. After the amendments, police may use facial recognition for any infraction, including jaywalking and participation in prohibited assemblies such as the Budapest Pride march.

Civil society organizations including the European Center for Not-for-Profit Law (ECNL), the Hungarian Civil Liberties Union (HCLU), and European Digital Rights (EDRi) have published legal analyses concluding that the amendments violate the AI Act's prohibition on real-time biometric surveillance. The European Commission's 2025 Rule of Law Report for Hungary noted the legislation. The practical question of whether Hungary can be compelled to comply before the high-risk rules take full effect in 2026 remains unresolved.

Penalties Summary

Civil Remedies for Unauthorized Recording

Beyond criminal prosecution and GDPR fines, unauthorized recording creates civil liability under multiple frameworks.

Under the Civil Code, the person whose voice was recorded without consent may bring a personality rights claim seeking injunctions against further use of the recording, orders for its deletion, publication of the court judgment, and sérelemdíj compensation. Because sérelemdíj does not require proof of financial harm, it is accessible even where the recording caused only dignity-based injury.

Under Act LIII of 2018 on the Protection of Privacy, the statutory right to respect for private life including voice recordings provides a separate civil cause of action. Having multiple statutory bases available increases a claimant's procedural options.

Both civil tracks can proceed concurrently with criminal prosecution and NAIH proceedings. A single recording incident can generate four simultaneous proceedings: criminal prosecution, NAIH investigation, Civil Code personality rights claim, and Privacy Protection Act claim. Consult an attorney for advice specific to your situation.

Phone Calls: All-Party Consent in Practice

Hungary applies all-party consent to phone and VoIP calls without exception. Every party on the call must be informed and must consent before recording begins.

Business Call Recording

Organizations that record customer calls, including banks, insurance companies, call centers, and telecommunications providers, must satisfy both GDPR and Criminal Code requirements simultaneously.

NAIH's call center guidance requires organizations to provide "easy-to-understand information" at the start of every recorded call. The disclosure must cover the purpose, storage period, data subject rights, and whether any AI or automated processing will be applied to the recording. A formulaic announcement covering only "quality assurance" falls short, as the Budapest Bank case demonstrated.

When AI is used to analyze calls, including keyword spotting, sentiment analysis, or voice biometrics for authentication, separate explicit consent is required for the AI processing beyond consent to recording itself.

The Reciprocal Recording Right

Hungarian civil law includes a reciprocal recording principle rooted in the mutual cooperation obligation (együttműködési kötelezettség). If a business records a phone call with a customer, the customer has an equal right to record that same conversation.

The reciprocal right has a strict limit: the customer may use their recording only for the enforcement or defense of a legal claim in a future dispute. Publishing, sharing, or using the recording for any other purpose would violate the personality rights of the business representatives on the call and potentially expose the customer to criminal liability under Btk. § 422.

In-Person Recording: Private and Public Settings

Private Settings

Recording face-to-face conversations in private spaces requires the consent of all participants. Btk. § 422(1)(b) specifically criminalizes using technical devices to record activities in another person's residence. There is no exception for conversation participants. A guest recording their host without consent violates the statute.

The private residence prohibition extends to any space where a person has a reasonable expectation of privacy: private offices, hotel rooms, medical consultation rooms, and similar settings.

Public Events and Crowds

Art. 2:48 of the Civil Code contains an explicit exception for crowd recordings and recordings of appearances at public events. No individual consent is required for general documentation of public gatherings.

This covers filming demonstrations, political rallies, concerts, parades, and sporting events. The reasoning is consistent with ECHR jurisprudence on privacy in public spaces: persons who appear in public places accept reduced privacy expectations regarding documentation of the event as a whole.

The exception has limits. Targeted surveillance of a specific individual at a public event, such as persistently following someone in a crowd or recording in a manner designed to enable identification rather than document the event generally, brings that recording back within the consent requirement.

Recording Police Officers and Public Officials

Hungarian law does not grant police officers or public officials blanket immunity from being recorded while performing their duties in public.

When an officer exercises official authority in a public setting, recording that conduct for the purpose of documenting potential unlawful behavior is generally permissible under the public event exception to Art. 2:48 and under the principle that public officials exercising public power have a reduced expectation of privacy with respect to that conduct.

Legal analysis from Hungarian practitioners indicates that recording police conduct is most defensible when:

• The officer is exercising official authority against you specifically (an arrest, a stop, a search)
• There is an objectively apparent basis to believe the officer may be acting unlawfully (unjustified physical force, threats, discriminatory conduct)
• The recording is made openly rather than covertly
• The purpose is to preserve evidence for a potential legal complaint

Covert surveillance of police in non-confrontational contexts remains criminal under Btk. § 422(2), which specifically prohibits gathering information to identify undercover law enforcement personnel. Recording openly and preserving the footage exclusively for legal proceedings is the safest position under Hungarian law.

Workplace Monitoring and Employee Recording

Hungary's Labour Code (Act I of 2012, amended April 2019) sets specific rules for workplace surveillance layered on top of general recording law.

Employer Rights and Limits

Art. 11(a) of the Labour Code permits employers to monitor whether employees fulfill their work duties using technical equipment, subject to three conditions:

1. The monitoring must be justifiably connected to the employee's specific work duties
2. It must be proportionate to the legitimate aim
3. It must be conducted with respect for human dignity

Surveillance cannot be used to measure employee productivity through continuous video or audio observation. Property protection is an accepted purpose; performance tracking through constant recording is not.

Prohibited Monitoring Locations

Recording devices may never be placed in showers and changing rooms, restrooms and toilets, kitchens and dining areas, or rest rooms and break facilities. The only exception is health and safety monitoring at industrial sites where physical danger requires it.

Notice and Works Council Requirements

Employers must inform employees in advance about all surveillance measures, covering the type of monitoring, its purpose, the retention period, and employees' data protection rights. Covert workplace surveillance is prohibited without exception. Even suspicion of employee misconduct does not create a lawful basis for secret monitoring.

Before implementing surveillance measures affecting a significant number of employees, employers must consult the works council (üzemi tanács). CCTV footage in the workplace may generally be stored for only three working days unless a specific legitimate reason justifies longer retention.

Voyeurism and Non-Consensual Intimate Images

Hungary addresses intimate image abuse through personality rights law and criminal provisions.

Civil Code Art. 2:48 provides the baseline: any recording of a person's image or voice without consent is a personality rights violation, triggering sérelemdíj liability without proof of financial harm. This protection applies comprehensively to intimate images.

For sexualized deepfakes and AI-generated intimate images, Btk. §§ 226/A and 226/B provide the primary criminal framework. Creating a fabricated intimate image of a real person with reputational harm as the purpose carries criminal liability regardless of whether any real recording exists. The crime is in the fabrication and distribution of false content.

Act LXXVIII of 2024 on Combating Online Aggression, which entered into force on 1 January 2025, introduced the offense of "internet aggression" into the Criminal Code. It penalizes publishing or using via electronic communications networks expressions, depictions, or audiovisual content expressing intent or desire for violent crimes against identifiable persons, with up to one year of imprisonment. While not a dedicated NCII statute, the provision covers harmful content distribution in ways that overlap with intimate image abuse.

The NMHH Internet Hotline has accepted reports of unauthorized intimate content since October 2024. Reports can be filed when images, videos, or audio recordings have been published online without the subject's consent.

Deepfakes and AI-Generated Content

Hungary's criminal provisions apply to AI-generated audio and video. The key question under Btk. §§ 226/A and 226/B is not whether a recording is authentic but whether it is false or manipulated and whether it is intended to damage the subject's reputation.

An AI-generated voice clone of a politician saying something they never said, distributed on social media, falls within § 226/B. A synthetic video of a private individual in a compromising scenario designed to harm their reputation is also covered. The sophistication of the AI tool used does not affect criminal liability.

The EU AI Act's transparency obligations add another layer from August 2024 onward. AI systems generating synthetic audio or video must disclose that the content is artificially generated. Deployers who distribute AI-generated recordings without that disclosure face regulatory exposure under the AI Act independent of any Btk. criminal liability.

Cross-Border Recording Considerations

Hungarian law applies based on both territorial and nationality principles.

When Hungarian law applies to a recording:

• Recordings made on Hungarian territory, regardless of participants' nationality
• Recordings made by Hungarian nationals abroad, for offenses qualifying as felonies under Hungarian law
• Personal data of Hungarian residents processed by organizations anywhere in the world where EU residents' data is processed in connection with offering goods or services to them (GDPR Art. 3)

EU one-stop-shop mechanism:

For organizations operating across multiple EU member states, the lead supervisory authority is determined by the organization's main EU establishment. An organization headquartered in Germany recording calls with Hungarian customers would be subject to primary GDPR enforcement through Germany's DPA, with the NAIH as a concerned supervisory authority.

Non-EU callers:

When a person in a non-EU country records a call with a Hungarian resident, Hungarian law applies to the Hungarian participant. The foreign participant's practical exposure under Hungarian criminal law is limited by jurisdictional reach, but the Hungarian participant retains the right to bring civil claims in Hungarian courts under Art. 2:48.

Conflicting consent standards:

When parties are in countries with different consent requirements, obtaining all-party consent before recording satisfies the most restrictive applicable standard. A US-based business calling a Hungarian customer should treat the interaction as requiring all-party consent under Hungarian law, regardless of which US state's one-party consent rules might otherwise apply to the American participant.

ECHR Oversight: Szabó and Vissy v. Hungary

Hungary's surveillance laws have faced international scrutiny. In Szabó and Vissy v. Hungary (Application No. 37138/14, 2016), the European Court of Human Rights found that Hungary's national security surveillance framework violated Article 8 of the European Convention on Human Rights.

The case arose from NGO staff members challenging the surveillance powers of Hungary's National Security Services under Act CXXV of 1995. The ECHR found that the regime was so broadly defined it could reach "virtually anyone," that authorization rested entirely with the executive branch without judicial oversight, that vast amounts of incidentally collected data from non-targeted individuals were captured, and that no effective post-hoc judicial review existed.

The judgment remains the controlling international authority on the outer limits of permissible state surveillance in Hungary. Hungary's March 2025 biometric surveillance expansion has renewed these tensions, with European institutions questioning the law's compatibility with both the AI Act and the ECHR.

Secret Recordings as Evidence in Court

The admissibility of secretly obtained recordings in Hungarian courts follows a balancing approach rather than automatic exclusion.

The Kúria (Hungary's Supreme Court) has ruled that "the mere fact that evidence is obtained illegally does not make it impossible to use in front of a court as evidence." Courts apply a case-by-case balancing test weighing the recorded person's data protection rights against the interests of procedural fairness and reaching a correct outcome.

In a landmark child custody case, the Kúria upheld the use of dictaphone recordings made during a psychological examination where written consent had not been obtained. The court characterized the missing written approval as a "minor procedural fault" rather than grounds for full exclusion, ordered the recording destroyed after use, but permitted the expert opinion based on it to remain in the case file.

Factors courts weigh include: whether participants were aware of the device; whether the recording was concealed or open; the importance of the evidence to the case outcome; whether data protection arguments are being deployed tactically to exclude unfavorable evidence; and the proportionality of the privacy intrusion against the interests of justice.

One critical point remains constant: court admissibility and criminal liability are entirely separate questions. Even when a court admits an illegally obtained recording into evidence, the person who made that recording remains criminally liable under Btk. § 422 and civilly liable under Art. 2:48. Admission as evidence does not immunize the recorder.