Hungarian data protection law generally forbids sub-processing of processing operations by data processors since 1999. This means in practice that a processor of processing services could not sub-contract data processing to other processors – even if the data subject and the controller consented hereto – which was an over-rigid provision that did not meet practical realities and therefore caused several problems in practice. The prohibition of sub-processing under Hungarian law did not take into account business trends and practices for multi-level processing, moreover, it also contradicted the processor-to-processor Model Clauses (2010/87/EU) which expressly authorizes sub-processing in the context of international data transfers.

Apparently, the above problem has very recently also caught the attention of the Hungarian legislator: the Information Act of 2011, the Hungarian implementation of the EU Data Protection Directive (95/46/EC), has been very recently amended by the Act L of 2013 and the legislator has now introduced a new Section 10 (2) into the Information Act which reads as follows:

“The data processor may sub-contract processing operations to another processor in line with the instructions of the data controller.”

After almost one and a half decades, the new Section 10 (2) of the Information Act now authorizes sub-processing of processing operations to other processors. Thus, provided that the processing agreement permits same, the processor will be able to delegate its processing services to another processor.

The above amendment of the Information Act will enter into force by 1 July 2013.