Callstrike
Compliance

Voice phishing simulations in Hungary

Phone numbers in HungaryProvisioned by Callstrike after approval

Hungary asks for more in writing than anywhere else in this portal and punishes one pretext harder than anywhere else. The reasoning behind a voice phishing simulation is handed to your workforce rather than filed for a regulator, and impersonating an official proceeding moves the relevant offence into a higher sentencing bracket. Numbers are supplied, but a campaign dialled from outside Hungary will not connect at all.

Phone numbers

Supplied by Callstrike

Local numbers in Hungary, after a one-time approval.

Running a simulation

Permitted, and the pretext is the risk

Posing as a public authority is a different sentencing bracket, not a worse look.

Consent

Written reasoning, handed over

Staff are entitled to read why the exercise is necessary and proportionate, in advance.

Getting a phone number in Hungary

One approval per country, completed in the console.

Provisioned by Callstrike after approval

Numbers here are not released from open inventory. Your workspace is cleared for this country once, and Callstrike then provisions a dedicated number against it for your simulations. Approval is a one-time, per-country step and usually takes 3 to 5 business days. We only ask for what the regulator requires.

Two documents carry the Hungarian filing and one of them has a shelf life. An excerpt from the commercial register proves the business identity, and a utility bill, a tax notice, a rent receipt or a title deed proves the local address. The address document must be dated within the last three months, so a copy pulled for an earlier filing will not do, and the address itself has to sit inside the locality or region the number's own prefix covers, with a post office box not accepted where a local address is required. The console form also takes your business website and the authorised representative's phone number and email alongside their name, typed rather than evidenced.

Then the rule that decides deliverability before any legal question arises, and it is blunt. Hungarian providers must examine a call arriving from an international direction before routing it, and a call presenting a non-mobile Hungarian number is classified as abusive on the identifier alone, in terms, without regard to the other circumstances of the call and in particular without regard to the content of the communication. Mobile numbers are blocked too unless the number is genuinely roaming. Geographic and short numbers have been inside the regime since October 2025 and mobile since June 2026. Nothing you can put in a file reaches a rule that is deliberately content-blind, so Hungarian traffic originates in Hungary or it does not arrive.

  1. 01Complete the regulatory clearance formYour administrator, in the Callstrike console. The form asks only for what the regulator requires.
  2. 02Approval is granted against your workspaceTypically three to five business days, and once only for as long as you operate here.
  3. 03A dedicated number in Hungary is assigned to youCallstrike
  4. 04Build and launch the campaignYour team
What you provideAccepted evidence, any one of
Proof of business identityExcerpt from the commercial register
Proof of local addressMust be within locality or region covered by the phone number's prefix; a PO Box is not acceptable where a local address is required. Address document must be dated in the last 3 months.Utility bill, Tax notice, Rent receipt, Title deed

These requirements are set by the carrier and can change. The form in the console is generated from their current rules, so treat it as authoritative and this table as a summary of what to have ready. Checked 2026-09-07.

Is it lawful to run a simulation in Hungary?

The position in short, before your counsel reads the detail below.

Yes, with one qualification we are not going to paper over. The Hungarian automated calling rule lives in the electronic communications act rather than in the advertising act, and it gates the use of an automated calling system on three purposes: direct marketing, information, and market research. Two of those plainly do not describe an internal security test. The third is the problem, because the word translated as information means, in ordinary Hungarian, informing; the act does not define it; and a call that tests and then teaches arguably informs. Suppliers commonly tell buyers the rule is scoped to marketing and an internal test therefore sits outside it. That claims more than the text supports, and we searched the regulator's material for a position on the point and found none.

What follows if the limb does reach you is worth designing for either way, because it points the same direction as everything else on this page: the same section provides that even with express consent, no communication for those purposes may be transmitted from which the sender's identifying data cannot be recognised. A concealed or unattributable calling identity is directly hostile to that requirement, so an attributable number is the safe design under both readings.

The sharpest Hungarian provision is criminal and it is about the pretext rather than the data. Illicit data acquisition is committed by a person who, for the purpose of the unauthorised acquisition of personal data or a private, economic or business secret, secretly spies out the content of a communication conducted over an electronic communications network and records what is perceived by technical means. The base offence carries up to three years. It rises to one to five years where the acquisition is committed by simulating an official proceeding, and a pretext impersonating the tax authority, the police or a regulator is precisely that. Nowhere else in our coverage is an aggravating circumstance drawn this closely around the shape of a pretext call, so a Hungarian scenario library should be written with the provision open. Whether a party to the call is inside the base offence at all is genuinely unsettled, and we leave it that way: a neighbouring offence in the same code reaches a person who spies out a communication transmitted to another, and this one contains no such word.

The civil code is the sharper constraint in practice and the easiest to miss. The right to one's voice recording is a named personality right, and the person's agreement is required both for the making of a recording and for the use of the one made. Those are two separate agreements, and the only exceptions are crowd recordings and recordings of public appearances in public life, neither of which describes a workplace telephone call. The regulator hardened its tone on covert audio in a December 2024 communiqué addressed to what it called a spreading unlawful practice. The practical reading is to design the exercise so it does not depend on retaining audio at all. Separately, and unlike several of its neighbours, Hungary has actually built the machinery for the European transparency duty: a 2025 implementing act is in force and a government decree designates a market surveillance authority with power to fine.

What your company needs to do

7 items, in the order you will need them.

  • Write the pretext library with the aggravator openHungary-specificKeep public authorities out of your scenarios. A pretext posing as the tax authority, the police or a regulator sits squarely in the aggravating circumstance that moves illicit data acquisition from up to three years to one to five. This is a scenario-design decision rather than a paperwork one, and it costs nothing to make correctly at the start.
  • Hand over the reasoning, not just the noticeHungary-specificIn advance and in writing, your workforce is entitled to the manner, the conditions and the expected duration of the restriction, and the circumstances substantiating its necessity and proportionality. Most countries want you to hold a balancing assessment. Hungary wants the reasoning given to the people it is about, before the restriction begins.
  • Ask the works council at least fifteen days before you decideHungary-specificThe statute names the application of a technical device serving the monitoring of employees in its own list, so there is no interpretive step to take. It is an opinion rather than an agreement, and the joint decision right covers welfare funds only. But fifteen days before the decision, not before the campaign, is a hard sequencing constraint that has to be in the plan from the start.
  • Originate the calls inside HungaryHungary-specificThe border filter is content-blind by design and says so in terms, so no authorisation letter or internal-test framing reaches it. A campaign dialled from a platform outside Hungary presenting a Hungarian number is blocked before anyone hears it ring. Confirm where your traffic originates before you plan anything else about delivery.
  • Design so the programme does not depend on keeping audioHungary-specificThe making of a voice recording and the use of the recording made each need the person's agreement, and that agreement is hard to obtain validly in an employment relationship. An exercise that records outcomes rather than conversations never has to answer the question, and the regulator's recent communiqué on covert audio is a reason to settle it early.
  • Do not rely on a blanket clause in the contract of employmentA personality right may not be waived in advance in a general manner, and a declaration disposing of one is valid only in writing. Whatever your standard contract says about monitoring, the specific advance document described above is what actually does the work here.
  • Keep the credential out of the systemMeasure the behaviour and discard what the pretext asked for. It also removes an element of the criminal provision rather than merely mitigating it, which is explained in the controls below.

The controls that do the work

How Callstrike is configured, and which provision in Hungary each choice answers.

Auto-hangup before disclosure

The bot ends the call at the moment an employee starts to give up a credential or a piece of personal data, so the thing the pretext asked for is never spoken into the system and never stored.

Read the Hungarian offence as a list of elements rather than as a description, and this control removes one of them. Illicit data acquisition needs the purpose of unauthorised acquisition, the secret spying out of the communication, and the recording of what is perceived by technical means. The call ends the moment an employee starts to give up a credential, and the exercise keeps an outcome rather than a capture, so the acquisition the provision describes does not happen and there is nothing recorded for the third limb to attach to. It answers the civil code the same way, because what is never captured is not a recording anybody has to agree to.

In-call debrief and follow-up

A second voice breaks character as soon as the call ends, explains what just happened and why it worked, and a follow-up email repeats it in writing while the moment is still sharp.

The labour code standard is that a restriction on a personality right must be absolutely necessary for a reason directly connected with the employment relationship and proportionate to the objective, and you have to write out the circumstances substantiating both. A second voice that breaks character the moment the call ends, with vishing training in writing the same day, is a concrete proportionality fact you can put into that document rather than an intention you assert in it.

Consent Management

Two modes: collect consent now, over email, Slack or Teams with a full audit trail per employee; or record that your organisation already has this covered, by uploading the policy, handbook clause or agreement and confirming the scope it applies to. The document is hashed, the attestation is signed and timestamped, and an audit email is issued. Included on every plan.

The Hungarian regulator's position is that the voluntariness of an employee's agreement cannot be construed, because refusing may cause material or non-material detriment in a subordinate relationship, so it is available only exceptionally. That settles what this is not. What it produces is the advance written document the labour code demands, dated before the restriction begins, and a hashed copy of the policy or internal rule you rely on with a signed and timestamped attestation of the scope it covers, which is the form a general advance waiver could never take.

SCORM module

An interactive web presentation on voice-phishing risk, delivered through your own LMS, which then invites the learner to opt into a web call with the bot. A call the person starts themselves in a browser is not a telephone call, so telephony rules do not reach it.

In Hungary this answers the delivery problem and the purpose gate at the same time. Callstrike's vishing simulator can deliver the same deepfake voice through a web call the learner starts themselves after working through the module. The communications act provision is written about an automated calling system or another automated device for establishing a subscriber connection, and a browser session establishes no subscriber connection, so the unclosable third purpose never has to be argued. The border filter has no Hungarian calling identifier to examine either. The European transparency duty is unaffected, which is why the module names the synthetic voice on its own face.

Consent Management is included on every plan. See AI voice phishing simulation and human-in-the-loop voice phishing for how each is delivered.

For your legal team

The sourced position

Everything above, with the instruments behind it. Every claim cites the statute or the regulator it comes from, so your counsel can verify it rather than rely on our summary.

The balancing test is a document employees are entitled to read

Hungary added nothing of its own to the lawful bases. Its information act says that processing within the scope of the GDPR is governed by the Regulation with the supplements it specifies, and those supplements are about the authority's powers and about processing ordered by statute rather than about employers. A legitimate interests security test therefore stands or falls on the Regulation itself.

The regulator's position on consent follows the familiar European line, and we will give it with a caveat about the document it comes from. In relationships directed at the performance of work, it says, the voluntariness of consent cannot be construed: in the subordinate relationship between employer and employee, refusing consent may cause the employee material or non-material detriment. Consent can therefore be invoked in workplace processing only exceptionally, essentially where it is unambiguous that the employee obtains unconditional advantages and can suffer no detriment from refusing.

The caveat is that this is archived material. The document everyone cites dates from November 2016, and the authority itself files it under an archive of guidance published before the GDPR became applicable. Its reasoning is the standard European position and nothing in it depends on the pre-GDPR statute, so we quote it. But it is not current guidance, and the only post-GDPR statement we could find on employer monitoring is a two-page communiqué from December 2019 that points readers at two of the authority's own decisions rather than stating requirements.

What carries the weight in Hungary is not regulator guidance at all. It is the labour code. An employee's personality right may be restricted where the restriction is absolutely necessary for a reason directly connected with the purpose of the employment relationship and is proportionate to the objective, and the employee must be informed in advance and in writing of the manner, the conditions and the expected duration of the restriction, and of the circumstances substantiating its necessity and proportionality.

Read that last clause slowly, because it is unusual and it is the whole Hungarian answer. Most countries require you to hold a balancing assessment and to publish a notice. Hungary requires the reasoning that substantiates necessity and proportionality to be given to the employee, in advance, in writing. The assessment is not an internal artefact you produce if a regulator asks. It is a document the workforce is entitled to read before the restriction begins.

One more provision closes the obvious escape. An employee may not waive a personality right in advance in a general manner, and a declaration disposing of a personality right is valid only in writing. A blanket clause in a contract of employment does not do the work here.

Faking an official call moves you into a higher bracket

Hungary has the sharpest pretext rule in this portal, and it is not in a data protection instrument.

The criminal offence of illicit data acquisition is committed by a person who, for the purpose of the unauthorised acquisition of personal data, a private secret, an economic secret or a business secret, secretly spies out the content of a communication conducted over an electronic communications network or device and records what is perceived by technical means. The base offence is a felony carrying up to three years. Passing on or using what was acquired is punished the same way.

The aggravated form is where Hungary becomes specific in a way nowhere else does. The penalty rises to one to five years where the illicit acquisition is committed by simulating an official proceeding, on a commercial basis, in a criminal association, or causing significant detriment to interests. A pretext that impersonates a tax authority, the police or a regulator is precisely the first of those. Nowhere else in our coverage is there an aggravating circumstance drawn this closely around the shape of a vishing call, and a Hungarian pretext library should be written with it open.

Whether a party to the call is inside the base offence at all is genuinely unsettled, and we are going to leave it that way. The elements require a purpose of unauthorised acquisition and secretly spying out the communication, and a person who is on the call is not obviously spying out their own conversation. A neighbouring offence in the same code makes the point by contrast: it reaches a person who spies out a communication transmitted to another over an electronic communications network, and that phrase, to another, is exactly what a participant is outside of. The illicit acquisition provision contains no such word. We found no decision of the supreme court resolving it, so we report the elements rather than the answer.

The civil code is the sharper constraint in practice and it is easy to miss. The right to one's voice recording is a named personality right, and consent of the person concerned is required both for the making of a voice recording and for the use of the recording made. Those are two consents, not one. The only exceptions are crowd recordings and recordings of public appearances in public life, and a workplace telephone call is neither. The labour code applies the personality rights chapter to the employment relationship directly.

The regulator has also hardened its tone on covert audio recently. In a December 2024 communiqué addressed to what it calls a spreading unlawful practice, it holds that where a recording is made in the framework of other activity, including on a stockpiling basis, or is used as evidence in a proceeding or published, the processing falls within the scope of the GDPR and the person operating on the recording becomes a controller. It accepts that an outstandingly weighty public interest may exceptionally compete with the protection of the private sphere, while insisting that the exception cannot hollow out the constitutional guarantees and that careful, thorough, fair and accountable weighing is a fundamental obligation of the controller.

The practical reading for a Hungarian campaign: assume you need the employee's consent to make and to use any recording of their voice, assume that consent is hard to obtain validly in an employment relationship, and design the exercise so that it does not depend on retaining audio.

A purpose gate with one word in it we cannot close

Hungary's automated calling rule is in the electronic communications act and not, despite what most summaries say, in the advertising act. We counted the advertising act through for the words for automated, calling system and without intervention, and none of them appears in it. Its consent rule is about advertising by email and equivalent individual communication devices.

The communications act provides that an automated calling system operating without human intervention, or another automated device for establishing a subscriber connection, may be used in respect of a subscriber for the purposes of direct marketing, information or market research only where the subscriber has consented in advance, and may not be used for opinion polling where the subscriber has objected.

That is a purpose gate rather than a flat prohibition, and two of its three purposes plainly do not describe an internal security test. The third is the problem. The word translated here as information means, in ordinary Hungarian, informing. The act does not define it, and only one limb of the section ties back to the advertising act's definitions. A call that tests and then educates staff arguably informs them. We searched the regulator's material for any position on whether an internal security test falls inside that limb and found nothing.

So we are not going to tell you that Hungary's automated calling rule is scoped to marketing and that an internal test therefore sits outside it. That assertion is commonly made and it claims more than the text supports. What we will say is what follows if the limb does reach you: the same section provides that even with the subscriber's express consent, no communication for those purposes may be transmitted from which the sender's identifying data cannot be recognised. A concealed or unattributable calling identity would be directly hostile to that requirement.

Article 50 of the EU AI Act applies here without any Hungarian act being needed. Since 2 August 2026 a provider must design systems intended to interact directly with people so that those people are informed they are dealing with an AI system, and a deployer of a system generating or manipulating audio constituting a deep fake must disclose that the content is artificially generated, in each case at the latest at the first interaction or exposure. The exceptions cover use authorised by law for criminal law purposes and evidently artistic work, and an internal exercise is neither.

The same Regulation prohibits, since 2 February 2025 and at up to thirty-five million euros or seven per cent of worldwide turnover, using AI systems to infer emotions of a natural person in the workplace outside a narrow medical or safety exception. The prohibition is gated by a definition confined to inference from biometric data, and the recitals exclude the mere detection of readily apparent expressions or of a raised voice. Counting who disclosed a credential is unaffected. Emotion scoring of named employees is a fight you would be having at seven per cent of turnover.

Hungary, unlike several of its neighbours, has actually built the machinery. A 2025 act on implementing the Regulation is in force, and a government decree designates the national accreditation authority as the notifying authority and the minister responsible for enterprise development as both the market surveillance authority and the single point of contact. The act also empowers that authority to impose administrative fines and establishes a national artificial intelligence council. The data protection authority is not among the designations.

A border filter that ignores what the call is for

This is the most product-relevant thing on the Hungarian page, and it decides deliverability before any legal question arises.

Hungarian providers of publicly available telephone service must, before routing a call arriving into their network from an international direction, carry out an examination designed to prevent identifier abuse, and may route the call onward only if the conditions in the regulator's decree are met. The decree defines an examined international call as one arriving directly from an international direction through an international interconnection point with a calling identifier belonging to Hungary's country code.

Then it defines the test, and the definition contains the sentence that matters. An abusive call is one classified as abusive solely on the basis of the improper use of the identifier, without regard to the other circumstances of the call, and in particular without regard to the content of the communication. A call using a non-mobile Hungarian number as its calling identifier is abusive unless it is directed to a technical number, and where a call is abusive the provider must ensure it is not set up. A call using a Hungarian mobile number requires further checking and is blocked unless the number is genuinely roaming on an international mobile network.

The regime is fully live. It applied to geographic and short numbers from 15 October 2025 and to mobile numbers from 1 June 2026, and both dates are behind us. The regulator publishes the list of technical numbers and providers must check their network settings against it monthly.

The consequence for a simulation is blunt and worth stating without hedging. A campaign dialled from a platform outside Hungary that presents a Hungarian number will be blocked at the border, by law, and no authorisation letter, consent record or internal-test framing reaches it, because the rule is deliberately content-blind. Hungarian traffic has to originate on a Hungarian interconnect with a number the operator can verify.

On the narrower question of whether a caller may present a number it does not hold, the numbering plan does not answer it in those terms. It puts the duty on the operator: the calling identifier may be used only in the manner and format the numbering plans specify, and the caller's provider is responsible for the applicability of the network-verified identifier, for the number's allocated status, for its plan-conforming format and for its dialability. The only place caller entitlement appears is a provision letting the provider present a freephone or short number for whose use the caller has acquired entitlement, with the provider responsible for verifying it. For ordinary geographic and mobile numbers the decree does not say, and we are not going to infer a caller-facing prohibition from an operator-facing blocking regime. Premium-rate numbers may never be presented as a calling identifier.

What the country matrix holds for Hungary

Number types:
Local
Restricted for automated outbound:
None recorded

Generated from the same country matrix the platform enforces at dispatch, so it cannot drift from what you can actually buy.

Two written notices, and fifteen days before the decision

Hungary's paperwork comes in two layers that are often run together, and separating them is the fastest way to get a programme through.

The first layer is the monitoring provision. The employee may be monitored in respect of conduct connected with the employment relationship, the employer may apply a technical device within that framework, and the employer must inform the employee of this in advance and in writing. The rest of the section is about computing equipment the employer provides, the rule that it may be used only for performing the employment relationship absent agreement otherwise, and the employer's right to inspect employment-related data stored on it.

Notice what that section does not contain, because a great deal of secondary writing attributes it there. There is no human-dignity clause in it and no prohibition on monitoring private life. Those live in the personality rights provision described earlier, and in the civil code chapter it applies. The older labour code section that did carry an express dignity clause was replaced wholesale in 2019.

The second layer is that personality rights provision, and it is the demanding one: the advance written notice must set out the manner, the conditions and the expected duration of the restriction, and the circumstances substantiating its necessity and proportionality. In practice a Hungarian programme produces one document that does both jobs, and the part that takes the work is the last clause.

Then the works council, where Hungary is unusually explicit. At least fifteen days before its decision, the employer must seek the works council's opinion on the draft of employer measures and internal rules affecting a larger group of employees, and the enumerated list of such measures expressly includes both the processing and protection of personal data relating to the employee and the application of a technical device serving the monitoring of the employee. There is no interpretive step to take: monitoring technology is named in the statute by its own words.

It is consultation, not agreement. The employer seeks an opinion and then decides; the joint decision right elsewhere in the same chapter covers the use of welfare funds and nothing else. Overstating the works council's role as a veto is the obvious error and the sections do not support it. What the provision does impose is a hard sequencing constraint: fifteen days before the decision, not before the campaign, so it has to be in the plan from the start.

Thresholds decide whether any of this applies. Employees elect a works representative where the average headcount exceeds fifteen and a works council where it exceeds fifty, so a smaller Hungarian employer owes the two written notices and no consultation at all.

An audit with a closed list, and nothing in it about people

Hungary's cybersecurity regime is governed by a 2024 act, and the first thing to say is that its predecessor is dead. The 2023 act that many sources still describe ceased to be in force on 1 January 2025, and the official register serves it cleanly with a 2024 header date and no repeal banner anywhere in the body. Only the register's own version interface discloses the expiry. A page describing the Hungarian regime from that act would be describing something that stopped existing twenty months ago.

The current act runs on audit rather than on self-attestation. Organisations in scope must have a cybersecurity audit carried out every two years, or when the competent authority orders one, must contract an auditor from the official register within one hundred and twenty days of registration, and must complete the first audit within two years of registration.

The audit's content is a closed enumeration and it is worth reading against the question this page answers. The auditor may carry out an internal information security and remote vulnerability assessment, and in the significant or high security classes penetration testing; a cryptographic conformity assessment; and in those same classes a security source code review of custom-developed software performing critical security functions. That is the list.

We searched both the current act and its predecessor for the Hungarian and English terms for social engineering, phishing, deception, psychological and security awareness. All of them return nothing. The Hungarian cybersecurity audit does not mandate a vishing simulation, a phishing simulation, or any testing of people, and a vendor telling a Hungarian buyer that it does is wrong.

For financial entities the European digital operational resilience Regulation applies directly from 17 January 2025, and the central bank is designated by statute to carry out its implementation. The Regulation requires a testing programme covering vulnerability assessments and scans, open source analyses, network security assessments, gap analyses, physical security reviews, questionnaires and scanning solutions, source code reviews where feasible, scenario-based tests, compatibility, performance and end-to-end testing and penetration testing, and requires advanced threat-led penetration testing at least every three years on live production systems for the entities identified for it.

We counted that Regulation through as well. The phrase social engineering does not appear anywhere in it; the only match for the word social in the entire text is the name of a European committee in the recitals. If a Hungarian financial entity wants to locate a voice exercise inside the Regulation, the hooks are the scenario-based tests wording and the red team framing in the provision on testers, and neither is a mandate.

Take this further

Research prompt for your own AI assistant

Paste into Claude, Harvey or your firm's tool to pressure-test the position above.

You are advising on an authorised internal security exercise in HUNGARY. Our own employees receive a simulated voice-phishing call, placed by our vendor on our instruction, to measure susceptibility. No credential is captured or stored. The workforce is informed in advance and in writing.

Verify or correct each proposition below against primary Hungarian sources, and tell me what our written notice has to contain:

1. ⚠ Eht. § 162 gates automated calling on «közvetlen üzletszerzés, TÁJÉKOZTATÁS, piackutatás». Tájékoztatás is undefined in the Eht. Does an internal security-awareness call fall inside that limb? Is there any NMHH or NAIH position? Do NOT assume the rule is scoped to marketing.
2. ⚠ The Grtv. contains NO automated-calling provision at all (zero hits for automat, hívórendszer, beavatkozás nélkül). Confirm the rule lives exclusively in Eht. § 162.
3. ⚠⚠ Btk. § 422(4)(a) raises tiltott adatszerzés from up to 3 years to 1 to 5 years where committed «hivatalos eljárás színlelésével». Confirm, and advise which pretext personas are inside it.
4. Is a PARTY to the call inside § 422(1) at all, given «titokban kifürkészi» and the contrast with § 223's «másnak»? Supply any Kúria authority.
5. ⚠ Mt. § 9(2) requires advance WRITTEN information of the manner, conditions and expected duration AND «a szükségességét és arányosságát alátámasztó körülmények». Confirm the balancing reasoning is disclosed, not merely held.
6. ⚠ Mt. § 11/A carries ONLY the employment-connection limit and the prior written information duty; it has NO human-dignity clause. Those live in § 9(2) and Ptk. §§ 2:42 to 2:54. Confirm, because most secondary writing puts them in § 11/A.
7. Mt. § 264 requires the works council's opinion at least 15 days before the decision and names «a munkavállalóra vonatkozó személyes adatok kezelése» and «a munkavállaló ellenőrzésére szolgáló technikai eszköz alkalmazása». Confirm it is opinion, not agreement.
8. Ptk. § 2:48 requires agreement for BOTH the making and the use of a voice recording, with only crowd and public-appearance exceptions.
9. 4/2012. (I. 24.) NMHH rendelet blocks inbound international calls on the identifier alone «a hívás tartalmára tekintet nélkül», live for mobile since 01-06-2026. Confirm there is no exception any authorisation could reach.

Flag anything that has changed since September 2026, and identify any obligation in our own kollektív szerződés that this analysis omits.

Common questions

What must Hungarian employees be given in writing?
More than a notice. In advance and in writing: the manner, the conditions and the expected duration of the restriction on their personality right, and the circumstances substantiating its necessity and proportionality. The balancing reasoning is handed to the workforce rather than filed for a regulator.
Does the works council have to agree to the campaign?
No, but it must be asked at least fifteen days before the decision, and the statute names the application of a technical device for monitoring employees in its list of measures. The joint decision right covers welfare funds only. A works council exists above fifty employees.
Is impersonating a public authority worse in Hungary?
Materially worse. The offence of illicit data acquisition carries up to three years, but rises to one to five years where it is committed by simulating an official proceeding. A pretext posing as the tax authority, the police or a regulator sits squarely in that aggravating circumstance.
Why would our Hungarian calls not connect?
Because operators must block inbound international calls presenting a Hungarian number, and the rule says in terms that abusiveness is decided on the identifier alone without regard to the content of the call. Fixed numbers since October 2025, mobile since June 2026. Originate domestically instead.

Elsewhere in Central and Eastern Europe

The rules differ by country even inside one region. These are the nearest guides to this one, each showing how phone numbers are obtained there.