Home›Company›Strategy›Hungary GTM
Strategy document · internal / partner briefing

XcellHost|Hungary Go-To-Market Strategy

Hungary's NIS2 law has applied since 1 January 2025, and the first mandatory cybersecurity audits were due by 30 June 2026. Audits now repeat every two years. This is how XcellHost enters: partner-led, data kept in the EU, and backed 24×7 from Mumbai.

Cloud · Cyber Security · Data Protection · Digital Trust · AI · Training. Every market number and legal status on this page is sourced and dated, as of 11 November 2026.

Cloud in Hungarian & EU partner DCs
SOC, NIS2 audit & DORA readiness
Backup, DR & GDPR operations
PKI, HSM & certificate lifecycle
AI platforms, RAG & GPU
AI literacy & cyber training
Read the summary → Revenue model
01 Market · where the money isSimplified outline, not to scale · figures sourced below BRIEF
US$239.6M cyber security market, 20251 0.4% GDP growth, 202512 245 business-service centres10 ~3,500 entities in the NIS2 audit regime27 9% corporate income tax42 US$2.41B India–Hungary trade, 202513
Executive summary

Enter Hungary through partners and the NIS2 audit cycle

The case on one screen: what the market is worth, why the timing works, how to enter and what we aim to reach in 18 months.

The opportunity
US$590M

Cyber security (Mordor, 2025) plus AI (US ITA, 2024) in Hungary12. That is about . We found no reliable Hungarian cloud market-size figure, so cloud is left out. Hungary is a smaller, earlier-stage market than Poland.

  • Cyber security: US$239.6M in 2025, growing 7.74% a year to 2031. BFSI is the largest buyer at 27.1%1.
  • AI: US$350.2M in 2024, projected at US$1.5B by 20302. Only about 10% of Hungarian firms used AI in 2025, against 20% across the EU46.
  • Digital economy: 6.7% of gross value added, about US$31.5B, in 2025 (estimate)2.
  • NIS2 audits alone are worth at least HUF 5.5B per two-year cycle at the lowest fee level27.
Why now
8 deadlines

Eight dated EU compliance and technology deadlines fall between December 2026 and December 2027, on top of the two-year NIS2 audit cycle. See the trigger calendar.

  • Act LXIX of 2024 (NIS2) has applied since 1 Jan 2025. First audits were due by 30 Jun 2026 and repeat every two years2526.
  • DORA has applied since 17 Jan 2025. MNB Recommendation 2/2025 on cloud applies from the same day41.
  • AI Act: Hungary's Act LXXV of 2025 is in force, with its AI authority provisions from 2 Aug 202638. Annex III high-risk duties start on 2 Dec 202736.
  • EU funds: in 2026 Hungary agreed with the Commission to draw down €16.4B of frozen funds, and its revised €10B recovery plan was approved on 19 Jun 202624.
Recommended entry model
Partner-led

Hungarian DC partner, local SI/MSP resellers and a licensed NIS2 auditor as alliance partner first. Open a Kft. between month 6 and 12.

  • Host regulated workloads in a Budapest partner DC or in XcellHost's EU partner DCs, so the hosting itself is not a third-country transfer.
  • A Kft. needs HUF 3 million of share capital and an attorney-countersigned deed. The court decides within 15 business days46.
  • Run tooling, playbooks and the second line from the Mumbai 24×7 NOC & SOC. India has no EU adequacy decision, so this runs under SCCs with a transfer assessment3132.
18-month goalsTargets for leadership to confirm. They are not forecasts. Accounts and revenue follow the revenue model (base case by default).
Goal · active partners61 DC + 1 auditor + 4 SI/MSP
Goal · paying accounts24across 10 verticals
Goal · annualised revenueUS$681k≈ ₹6.5 crore
Goal · readiness assessments14NIS2 audit-readiness + DORA
Market size

Sized from published sources, as ranges

Analysts differ. Where they do, we show both figures. INR equivalents use ₹95.17 per US$, the close on 26 Oct 202647. HUF figures are converted at HUF 323.26 per US$, the rate on 18 Oct 202648, and EUR at €0.8925 per US$ (23 Oct 2026)49. All are for orientation only.

Cyber securityUS$105.7–239.6MUS ITA: cyber solutions US$105.7M (2024) · Mordor: US$239.6M (2025), US$374.7M by 2031≈ – US ITA2 · Mordor Intelligence1. Scopes differ.
Artificial intelligenceUS$350.2M2024 · US$1.5B by 2030 · CAGR 28.48%≈ US ITA Country Commercial Guide2. The ITA does not name its underlying source.
NIS2 audit marketHUF 5.5–20BPer two-year cycle · about 3,500 audited entities · 10 auditors on the SZTFH register≈ US$17–62MTelex, 8 Jun 202627. Low end at minimum fees; high end is a market estimate.
Data centres18 listed DCs13 in Budapest · Magyar Telekom expanding its Budapest site capacity by 20%MW capacity: not re-verifiedData Center Map7 · TelcoTitans9. No reliable MW figure was found.
Business services245 centresNearly 120,000 jobs in 2025, up from about 120 centres and 55,000 jobs in 2019TCS, Wipro, Cognizant, Tech Mahindra presentHIPA 2025 sector survey10 · MEA13
Adoption gap~10% use AIKSH 2025: ~10% of firms use AI and nearly half pay for a cloud service · EU: 20% AI, 52.7% cloud61% of firms at basic digital intensity · EU 72%KSH via HVG4 · Eurostat56
Market size by segmentUS$ million. The bar shows the low–high range across sources.

Sources: 1, 2, 27. HUF converted at 323.26 per US$.

Hungary against its benchmarksPercent. Blue: Hungary · dark: EU average or 2030 target.

Sources: KSH via HVG (4), Eurostat (6), Digital Decade 2025 country report (3)

Anchor employers we citeDirect employees. Each is a potential buyer or a supply-chain trigger, not a customer.

Sources: Audi (14), DT-ITS (11), electrive (15), BMW Group (16)

Cyber security and AI outlookUS$ million. Endpoints from Mordor (cyber, 2025–2031) and US ITA (AI, 2024–2030). Years between are interpolated at the implied CAGR.

Sources: Mordor (1), US ITA (2). Interpolation is ours.

TAM · SAM · SOM for XcellHost

From the whole market to what we can realistically win

TAM is the sum of two separate estimates: cyber security (Mordor, 2025) and AI (US ITA, 2024). They may overlap, for example AI security, and use different years, so treat TAM as indicative. No reliable cloud or IT-training market size was found, so both are left out. SAM and SOM are our assumptions. You can change them in the revenue model.

TAM · total addressableUS$589.8MCyber 239.6 (2025) + AI 350.2 (2024), US$ million12
SAM · serviceable · assumptionUS$58.98M10% of TAM: managed and partner-delivered services in our six pillars, in Budapest, Győr, Debrecen, Kecskemét and Székesfehérvár
SOM · obtainable in ~18 months · assumptionUS$681kBottom-up: target accounts × win rate × ACV across 10 verticals. That is 1.2% of SAM.
Key verticals · top 10 services · buying triggers

Ten verticals, each with its own top 10

Pick a vertical. Each one shows why it matters, with sourced facts, then its regulatory drivers, who buys, the ten XcellHost services to lead with and the events that open a deal. Every service links to its XcellHost page. Companies named are context only, not customers.

XcellHost service pages describe the Indian offer, with INR pricing and Indian compliance. For Hungary, each service will be re-scoped with partners for EU hosting, GDPR processor terms and HUF or EUR billing. Priority waves are our judgement.

Buying triggers · calendar

Dated events that open budgets

EU and Hungarian compliance deadlines, platform end-of-life dates and certificate-lifetime cuts give sales a calendar. Undated triggers, such as a ransomware incident, an audit finding or a new plant, are listed under each vertical above.

    EU & Hungarian IT and data-protection laws · status at 11 Nov 2026

    Laws, their status and how we respond

    A neutral summary of laws we checked against official and law-firm sources. Not legal advice: confirm each point with Hungarian counsel before contracting. As an EU member state, Hungary applies EU regulations directly and transposes directives into Hungarian acts, such as Act LXIX of 2024 on cybersecurity.

    Law / instrumentStatus & datesKey obligationsImplication & XcellHost response
    Act LXIX of 2024 on Hungary's cybersecurity (NIS2)Supervisor: SZTFH (Supervisory Authority for Regulatory Affairs) · incident handling: NKI (National Cyber Security Centre)28In forceEnacted 20 Dec 2024, in force 1 Jan 2025, repealing Act L of 2013 and the 2023 act25. Amendments in force 31 May 202526.Entities report their data to the authority within 30 days of falling in scope, sign an audit contract within 120 days of registration and complete an audit within two years, then every two years29. First round: audit contracts by 31 Aug 2025, audits by 30 Jun 202626. Audits must come from auditors on the SZTFH register; SZTFH Decree 6/2026 eased auditor conditions on 8 Jun 202627. Fines for essential entities reach €10M or 2% of global turnover28. Supervision fee up to 0.015% of turnover, capped at HUF 10M29.Implication: about 3,500 entities run a two-year audit cycle27, and audit findings need remediation.
    Response: audit-readiness and remediation alongside a licensed auditor partner, then managed SOC, GRC and supplier assurance.
    Act LXXXIV of 2024 on the resilience of critical entitiesTransposes the CER Directive; repeals Act CLXVI of 2012In forceFirst phase from 30 Dec 2024. Material provisions from 1 Jan 202525.The government designates a general competent authority and a separate one for the energy sector. Designation procedures had to start by 30 Apr 202525. We did not re-verify which entities have been designated.Implication: energy, transport, health and other critical operators combine physical and cyber resilience duties.
    Response: OT assessments, resilience operations and tested DR runbooks.
    Cyber Resilience Act (CRA)Regulation (EU) 2024/2847Reporting liveReporting duties apply from 11 Sep 2026. Most obligations apply from 11 Dec 202734.Manufacturers of products with digital elements report actively exploited vulnerabilities and severe incidents: early warning in 24 h, notification in 72 h, final report in 14 days (vulnerabilities) or one month (incidents), through ENISA's Single Reporting Platform34.Implication: Hungarian electronics, automotive-electronics and device makers need vulnerability handling now.
    Response: cloud code signing, IoT PKI and a 24 h reporting runbook.
    GDPR + Act CXII of 2011 (Infotv.)Supervisor: NAIH (National Authority for Data Protection and Freedom of Information)In forceIn 2025 NAIH ran 4,855 investigations (+37%) and 893 inspections (+52%), with fines of about HUF 98M in total30.The largest Hungarian fine to date, HUF 250M, went to Budapest Bank for AI analysis of customer calls, including emotional state, without an adequate DPIA. 2025 focus areas: AI in banking, workplace CCTV, webshop privacy notices and health data30.Implication: AI on personal data needs a DPIA first, and as a processor XcellHost is audited by customers.
    Response: EU hosting by default and privacy operations adapted to GDPR and Infotv.
    GDPR transfers to IndiaChapter V · SCCs: Decision (EU) 2021/914In forceIndia is not on the Commission's adequacy list31.Transfers need a tool such as the standard contractual clauses. Clause 14 requires the parties to assess the destination's laws and practices, a transfer impact assessment (TIA)32.Response: EU hosting by default, processor SCCs with a documented TIA for Mumbai support, and encryption with EU-held keys via Cloud HSM.
    EU Data ActRegulation (EU) 2023/2854In forceApplies from 12 Sep 2025. Access-by-design from 12 Sep 2026. Switching and egress charges must go by 12 Jan 202733.Data holders give users access to connected-product data. Cloud and edge providers remove switching barriers and add safeguards against unlawful third-country government access33.Implication: vehicles, batteries and industrial kit made in Hungary are connected products.
    Response: no exit fees, documented export formats and a migration offer timed to Jan 2027.
    eIDAS 2.0 + Digital Citizenship Programme (DÁP)Regulation (EU) 2024/1183In forceEach member state offers an EU Digital Identity Wallet by 24 Dec 202635. The DÁP app had nearly 2.5 million downloads by Nov 202522.From 24 Dec 2027, regulated relying parties such as banking, energy, transport, health and telecoms, and very large platforms, must accept the wallet35. The 2025 Digital Decade report said Hungary's eID was not yet notified under eIDAS3.Implication: regulated firms need wallet acceptance and stronger PKI.
    Response: managed PKI, Cloud HSM and MFA integration. We partner with a qualified trust service provider for qualified signatures.
    EU AI Act + Digital Omnibus on AIReg. (EU) 2024/1689 · amended by Reg. (EU) 2026/1744In force · phasedBans and AI literacy from 2 Feb 2025. GPAI duties from 2 Aug 2025. The Omnibus took effect 27 Jul 20263637.Transparency duties apply from 2 Aug 2026. Annex III high-risk systems move to 2 Dec 2027 and Annex I (products) to 2 Aug 2028. New prohibited practices apply from 2 Dec 202636.Implication: customers need an AI inventory, risk classification and staff AI literacy.
    Response: vCAIO advisory, ISO/IEC 42001 and AI literacy training.
    Act LXXV of 2025 on implementing the AI ActWith Government Decree 344/2025 (X.31.)In forceAdopted 21 Oct 2025, in force 1 Dec 2025. AI authority governance provisions from 2 Aug 202638.As enacted in 2025: the National Accreditation Authority is the notifying authority, the minister for enterprise development the market surveillance authority, and the MNB the authority for high-risk AI in financial services. A Hungarian AI Council advises39. Designations may change after the 2026 change of government; not re-verified.Implication: banks face MNB scrutiny of high-risk AI, such as credit scoring.
    Response: AI security assessments and governance workshops before high-risk dates.
    DORARegulation (EU) 2022/2554 · supervisor: MNBIn forceApplies from 17 Jan 202540.ICT risk management, incident reporting, resilience testing and ICT third-party risk for financial entities, including a register of ICT providers40.Implication: banks and insurers audit every ICT provider, XcellHost included.
    Response: a DORA contract annex, audit and exit rights, and the BFSI Cloud evidence pack.
    MNB Recommendation 2/2025 on community and public cloudRead with Recommendation 1/2025 on IT system protectionAppliesIssued 13 Jan 2025, applies from 17 Jan 2025, and repeals Recommendation 4/2019. Not binding; applies to DORA entities where it does not conflict with DORA41.Assess risks of data location and document extra care for providers outside the EEA. Record processing locations at data-centre level. Give the institution and the MNB audit rights, including on-site. Keep an exit strategy and plan, and notify the MNB of an exit41.Implication: a Mumbai-hosted service for a Hungarian bank needs extra justification.
    Response: EU partner DCs for bank data, DC-level location records and an MNB-ready exit plan.
    Public-sector cloud use and state ITAct LXIX of 2024, section 9 · state agencies DMÜ, DKÜ, NISZCheck per projectCovered bodies may use non-private cloud or process data abroad only on the basis of their data classification29. In June 2026 the new government replaced the heads of DMÜ, DKÜ and NISZ and began an audit of state IT systems23.Classification sets where state data may sit. We could not confirm whether a separate decree requires in-country hosting for all state data; Act L of 2013, which earlier commentary linked to EU/EEA hosting, was repealed25.Implication: public work goes through Hungarian primes and in-country DCs.
    Response: sell only through partners, with a classification-to-hosting mapping per tender.
    Entity & taxKft. · CIT · local business tax · innovation contribution · VAT · WHTCurrentAs summarised by PwC (reviewed 1 Jul 2026)424344.Kft.: HUF 3M minimum capital, attorney-countersigned or notarised deed46. CIT 9%, local business tax up to 2%, innovation contribution 0.3% (micro and small firms excluded)42. VAT 27%, the EU's highest standard rate4345. No domestic WHT on dividends, interest or royalties paid to companies44.Response: see pricing & tax. Get Hungarian tax advice for each contract structure.
    PolicyEU funds unblocked. After the April 2026 election, the government agreed with the Commission to draw down €16.4B of frozen funds. The revised €10B recovery plan was approved on 19 Jun 2026, subject to 27 milestones due by the end of August24. Funded projects can create IT and security demand; we did not verify a digital share.
    PolicyIndia–Hungary. Bilateral trade was about US$2.41B in 2025. Indian investment in Hungary is about US$3.3B, and Indian firms there employ more than 10,000 people. The 11th Foreign Office Consultations were held on 10 Feb 202613.
    Competitive landscape

    Telecom-led and concentrated, so partner, don't fight

    Hungarian telecom and DC groups hold most local capacity, and NIS2 audits can only be done by auditors on the SZTFH register. We list the facts neutrally. Most local providers are partner candidates as much as competitors.

    ProviderTypeWhat we verifiedOur stance
    Magyar Telekom / T-Systems HungaryTelecom group, DC & cloudListed among major Hungarian DC players8. Running a two-year programme to raise its Budapest site capacity by 20%9.Neutral: partner or competitor
    4iG (incl. Invitech)Telecom & DC groupListed among major Hungarian DC players8.DC capacity partner candidate
    Dataplex (Telehouse)Colocation, BudapestListed among major Hungarian DC players8.Colocation partner candidate
    RackForest, ServergardenHosting & colocationListed among major Hungarian DC players8.Competitor in hosting. Neutral.
    HyperscalersPublic cloudIdomSoft, which builds the state DÁP platform, reports using public clouds including Azure and OCI alongside private cloud22. We did not confirm a hyperscaler cloud region located in Hungary (not re-verified).Co-sell through Managed Azure, Managed Google Cloud and Managed AWS
    Licensed NIS2 auditors (e.g. Hunguard, VantaSec, KÜRT)Cybersecurity audit firms10 auditors on the SZTFH register. Hunguard's 2025 revenue was HUF 2.44B27.Alliance partners: they audit, we remediate and run
    Deutsche Telekom IT Solutions HungaryCaptive IT services centreRanked the largest business-service centre in Hungary, with nearly 5,500 staff (2023)11.Neutral
    TCS, Wipro, Cognizant, Tech MahindraIndian IT services firmsOperate in Hungary, according to India's MEA13.Competitors in IT services; possible delivery partners
    NISZ, IdomSoft and state agenciesState IT providersNISZ, DMÜ and DKÜ leadership changed in June 202623.Not a target; public work only via Hungarian primes
    Go-to-market plan

    Four entry models, one recommendation

    We compare the options on speed, cost, compliance fit and control. Ratings are our judgement from the laws above.

    Entry modelTime to revenueUpfront costCompliance fitControl & marginVerdict
    Partner-led via local SI / MSP + licensed auditorFastLowStrongPartners hold relationships and Hungarian-language contracts; the auditor brings NIS2 findingsLowerStart here
    Hungarian DC partner + EU partner DCs + resaleMediumLow–mediumReserved racks or capacityStrongEU hosting; in-country racks where data classification or MNB expectations requireMediumStart here, combined with the above
    Direct entity (Kft.)MediumLow–mediumHUF 3M capital; staff and office are the real costStrongLocal HUF invoicing; 9% CIT on local profitHighOpen at month 6–12
    Acquisition or JV with a Hungarian MSPSlowHighStrongExisting references, Hungarian staff and public-sector accessSharedPhase 3 option, decided on traction

    Phased plan · 0–18 months

    0–6 monthsProve
    • Sign 1 Budapest DC partner, 1 licensed NIS2 auditor and 3 SI/MSP partners in Budapest, Győr and Debrecen
    • Get a Hungarian legal and tax memo on Act LXIX, DORA and MNB 2/2025, GDPR transfers and VAT
    • Localise 10 lead offers and the NIS2 audit-readiness assessment into Hungarian
    • Run 4 paid pilots: service centres, automotive suppliers and SMEs
    6–12 monthsEstablish
    • Open the Kft., register for VAT and invoice in HUF
    • Managed SOC and remediation retainers for entities with audit findings
    • AI literacy and cyber training cohorts in Budapest and Debrecen, with university partners
    • Co-hosted roundtables on NIS2 audits, TISAX, DORA registers and the AI Act
    12–18 monthsScale
    • Hire local presales and customer success. Add a second EU site for DR
    • Board decision on acquiring or partnering with a Hungarian MSP
    • Prepare customers for the second NIS2 audit cycle, two years after their first audit
    • Goal: ~24 accounts and ~US$0.68M annualised revenue (base case)

    Channel & partner programme

    • Referral partner: introduces deals. XcellHost contracts and delivers.
    • Resell partner: buys the XcellHost catalogue in EUR and bills customers in HUF.
    • Managed-service partner: runs L1 and the Hungarian-language desk. XcellHost runs L2/L3 and the platform.
    • Audit alliance: a registered NIS2 auditor audits; XcellHost fixes findings and runs controls, keeping the roles separate.
    • DC/cloud partner: provides Budapest racks, cloud capacity and the second site for DR.

    XcellHost has no published partner-programme page yet. Margins and tiers are for leadership to set. Partner enquiries: contact us.

    Pricing & tax approach

    • EUR price book for partners, with HUF billing by the partner or our Kft. later, and an INR reference for internal margin. Review FX quarterly: HUF 323.26 and ₹95.17 per US$ in Oct 20264748.
    • VAT: 27% standard, with reduced rates of 18%, 5% and 0%43. Cross-border B2B services usually fall under the reverse charge; confirm with an adviser.
    • Withholding tax: none under domestic rules on dividends, interest or royalties paid to companies44. PwC does not address service fees, so confirm per contract.
    • Kft. taxes: CIT 9%, described as Europe's lowest53, plus local business tax up to 2% and a 0.3% innovation contribution42.

    Marketing

    • Hungarian-language microsite, offer sheets and webinar decks, reviewed by native speakers. No machine-only translation.
    • Partner-hosted events in Budapest, Győr and Debrecen, timed to the trigger calendar: NIS2 audit cycles, EUDI wallets and AI Act dates.
    • Content: a NIS2 audit-finding remediation checklist, a DORA and MNB 2/2025 evidence pack, and a TISAX readiness guide for suppliers.
    • LinkedIn and partner co-marketing, plus outreach through India–Hungary business networks and HIPA events.

    Sales motions

    • Audit-led: a fixed-fee NIS2 audit-readiness or findings-remediation package that leads into managed services.
    • Follow the customer: Indian and global firms with Hungarian plants and service centres.
    • Supply-chain-led: TISAX and OT security for automotive and battery suppliers. TISAX labels last three years50.
    • Co-sell: with partners, plus Microsoft, Google and AWS, where XcellHost runs the managed layer.

    Team (assumption)

    RoleBaseFrom
    Country lead (Hungarian-speaking)BudapestMonth 0
    Partner managerBudapestMonth 1–6
    Solutions architectMumbai / remoteMonth 0
    Privacy & compliance leadMumbai + Hungarian counselMonth 0
    Presales + customer successHungaryMonth 9–12
    Delivery: NOC/SOC L2/L3Mumbai 24×7Existing team

    KPIs (goals, not forecasts)

    KPIM6M12M18
    Active partners356
    Readiness assessments sold4914
    Paying accounts41224
    Qualified pipeline (US$)0.3M1.0M2.0M
    Annualised revenue (US$)0.06M0.28M0.68M
    Gross margin on managed servicesTrack from month 1; set the target after pilots

    Risks & mitigations

    HighSmall, slow-growing market

    GDP grew 0.4% in 2025, and Mordor sizes the cyber market at about 15% of Poland's.

    Mitigation: focus on audit-driven and supply-chain demand, and run Hungary from a CEE hub plan.
    HighConcentrated local players

    Telecom-owned DC groups and a short list of licensed auditors shape buying.

    Mitigation: partner with them, and lead with managed security, digital trust and AI skills, not raw compute.
    MediumPolicy change after 2026 election

    New ministers, new agency heads and an audit of state IT systems; AI authority designations may move.

    Mitigation: a quarterly legal review with Hungarian counsel, and refreshes to this page.
    MediumData transfers to India

    Mumbai support is a third-country transfer, and the MNB expects extra care outside the EEA.

    Mitigation: EU hosting by default, SCCs plus TIA for support access, and DC-level location records.
    MediumAuditor independence

    NIS2 audits must come from registered auditors; we cannot audit what we run.

    Mitigation: an alliance model that keeps auditing and remediation separate.
    MediumLanguage & talent

    Enterprise and public buying happens in Hungarian, and ICT specialists are 4.5% of employment.

    Mitigation: a native country lead, localised content, and partner engineers trained by XcellHost.
    LowerFX & collections

    Changes in HUF, EUR, INR and USD rates, plus partner credit risk.

    Mitigation: an EUR price book, prepaid or quarterly billing, and partner credit limits.
    Lower27% VAT on local sales

    The EU's highest standard VAT rate raises end prices for non-deducting buyers.

    Mitigation: price for VAT-registered B2B buyers first; quote net and gross.
    Tool · SOM / revenue model

    Model the 18-month revenue

    Segments × target accounts × win rate × annual contract value (ACV). Every default is an assumption for discussion, not a forecast. Change any cell and the totals, the TAM/SAM/SOM block and the goals at the top update. Results are shown in US$, HUF, EUR and INR.

    Scenario Base · win rate ×1.0
    VerticalTarget accountsWin rate %ACV (US$)WonRevenue (US$)
    Total0——00
    Obtainable revenue (SOM) · assumption
    US$0
    ≈ ₹0
    In HUFHUF 0
    In EUR (€0.8925 per US$)€0
    Accounts won0
    Blended ACVUS$0
    SAM (TAM × SAM %)US$0
    SOM as % of SAM0%
    Discuss these assumptions →

    Illustrative. TAM = cyber security 2025 (Mordor) + AI 2024 (US ITA), sources 1 and 2. Not a financial forecast.

    Tool · vertical × service heatmap

    Where each pillar lands hardest

    Switch the view. Service fit counts how many of a vertical's top-10 services fall in each pillar, from our own mapping. Regulatory pull counts the laws in the table above that drive that pillar in that vertical. Both are our assessment, not market data. Click a cell to see its services.

    Select a cellThe mapped services and the laws driving that pillar appear here.
    SECURITY & COMPLIANCE

    Security And Compliance For Hungary

    The strategy above sets out a partner-led delivery model. Agree responsibilities, hosting locations and evidence requirements with each customer before deployment.

    Data Location

    Plan customer workloads in Hungarian or EU partner data centres, with transfer safeguards for any support access from India.

    Audit Readiness

    Prepare controls and evidence alongside an independent, registered Hungarian auditor.

    Operational Responsibilities

    Define monitoring, escalation, backup and recovery responsibilities in the customer agreement.

    Why XcellHost for Hungary Go-to-Market Strategy

    Since 199927 years of managed cloud and security from Mumbai
    Tier IV data centre + EU partner DCsMumbai for tooling and DR; EU partner DCs for EU data
    ISO 9001 · 27001 · 27017 · 27018 · 20000-1Evidence for NIS2 audits and DORA due diligence
    SOC 2 Type I & IIMeitY empanelled
    24×7 NOC & SOCSecond-line support behind Hungarian partners, 3.5–4.5 hours ahead
    Six pillars, one providerCloud to digital trust to AI training, so partners resell one catalogue

    Context: Hungary hosts 245 business-service centres with nearly 120,000 staff10, and Indian firms such as Apollo Tyres, Motherson, Sona BLW, Sun Pharma and TCS operate there13. Indian and global firms with Hungarian sites are a natural first customer segment.

    FAQ

    Questions partners will ask

    Short answers based on the laws and sources above. Not legal or tax advice.

    Not for phase 1. The plan sells through a Budapest DC partner, SI/MSP partners and a licensed NIS2 auditor first. A Hungarian Kft. needs HUF 3 million of share capital and an attorney-countersigned or notarised deed, and the court decides on registration within 15 business days. We plan to open one between month 6 and 12 so we can invoice in HUF and hire locally.

    No. Under Act LXIX of 2024 audits must be done by auditors on the SZTFH register, which listed 10 firms in June 2026. Auditing systems we also operate would also raise independence questions. Our role is audit readiness before, and remediation and managed controls after, working alongside a registered auditor.

    It can be transferred, but not by default. India has no EU adequacy decision, so processing in India needs a transfer tool such as the Commission's standard contractual clauses, plus a transfer impact assessment. The MNB expects banks to take extra care with providers outside the EEA, and public bodies may only use non-private cloud or process data abroad as their data classification allows. So customer data stays in a Hungarian partner DC or XcellHost's EU partner DCs, and Mumbai runs tooling, monitoring and second-line support under SCCs.

    The Digital Omnibus on AI took effect on 27 July 2026. It moved Annex III high-risk duties to 2 December 2027 and Annex I product duties to 2 August 2028. AI literacy has applied since 2 February 2025. Hungary's Act LXXV of 2025 sets up the national authorities, and in 2025 it named the MNB for high-risk AI in financial services. NAIH's HUF 250 million fine against Budapest Bank for AI analysis of customer calls shows that GDPR already applies to AI on personal data.

    Hungary hosts Audi in Győr, Mercedes-Benz in Kecskemét, BMW's new Debrecen plant and CATL's 100 GWh battery plant, which began trial production in September 2026. Their suppliers face TISAX assessments, OT security needs, the Cyber Resilience Act and NIS2 duties, which suit managed security, OT assessment, PKI and backup. These manufacturers are context, not customers.

    PwC says Hungary has no domestic withholding tax on dividends, interest or royalties paid to companies, but does not address service fees, so confirm each contract. VAT on cross-border B2B services usually works through the reverse charge; the standard rate is 27%. A Hungarian Kft. pays 9% corporate income tax, plus local business tax of up to 2% and a 0.3% innovation contribution. Get advice for each structure.

    We could not find a reliable published estimate of Hungary's cloud market or its data-centre capacity in megawatts. One analyst page we checked gave an implausible MW figure, so we left it out. We use adoption data from KSH and Eurostat and the number of listed data centres instead, and mark the gaps as not re-verified.

    No. The 18-month goals and the revenue model use assumptions for target accounts, win rates and contract values, chosen to start a discussion. Change them in the revenue model. Only the market-size, legal and macro figures come from cited third parties.

    Sources

    Every number, traceable

    Accessed 11 Nov 2026. The dates shown are publication or review dates where the source gives one.

    1. Mordor Intelligence — Hungary Cybersecurity Market (US$239.6M 2025, US$258.14M 2026 → US$374.74M 2031; CAGR 7.74%; BFSI 27.12%; healthcare fastest at 10.15%) · accessed 11 Nov 2026
    2. U.S. International Trade Administration — Hungary Country Commercial Guide: Digital Economy (6.7% of GVA; AI US$350.2M 2024 → US$1.5B 2030; cyber solutions US$105.7M 2024) · 12 Feb 2026
    3. European Commission — Digital Decade 2025 country report: Hungary (Council document ST 10407/25 ADD 14) · Jun 2025
    4. HVG — KSH digital economy survey: Hungarian firms' digital intensity, cloud and AI use in 2025 · 22 Jun 2026
    5. EUbusiness — 53% of EU enterprises used paid cloud services in 2025 (Eurostat: 52.7%) · 3 Feb 2026
    6. Eurostat — 20% of EU enterprises use AI technologies (up from 13.5%) · 11 Dec 2025
    7. Data Center Map — Hungary (18 data centres listed, 13 in Budapest) · accessed 11 Nov 2026
    8. Mordor Intelligence — Hungary Data Center Market (major players; used for operator names only) · accessed 11 Nov 2026
    9. TelcoTitans — Magyar Telekom to expand Budapest data centre amid 'tightening' capacity (+20%) · undated on page
    10. HIPA — Investor interest grows in the Hungarian business services sector (245 centres, nearly 120,000 employees) · 13 Nov 2025
    11. Deutsche Telekom IT Solutions — DT-ITS becomes the largest business service centre in Hungary (nearly 5,500 staff) · 9 Aug 2023
    12. Hungarian Central Statistical Office (KSH) — Economic performance 0.8% higher in Q4 2025; 2025 GDP +0.4% (raw) · 3 Mar 2026
    13. Ministry of External Affairs, India — India–Hungary bilateral brief (trade US$2,407.8M in 2025; Indian investment ~US$3.3B; Indian companies) · Jul 2026
    14. Audi — Audi Hungaria: stable production volume in fiscal year 2025 (1,585,290 drives; 200,756 vehicles; 11,430 employees) · 17 Mar 2026
    15. electrive — Mercedes celebrates plant expansion in Hungary and the production launch of the electric C-Class (~€1B; ~5,000 staff) · 14 Jul 2026
    16. BMW Group — BMW Group's newest, most innovative production site officially opens in Debrecen · 29 Sep 2025
    17. CarNewsChina — CATL's Hungarian plant with a planned 100 GWh capacity begins trial production · 22 Sep 2026
    18. The Pharma Letter — Gedeon Richter posts strong year-end (2025 revenue HUF 914B, +8.2%) · 27 Feb 2026
    19. OTP Bank — OTP Group (11 countries; 17.5 million customers; total assets €118B at Q4 2025) · accessed 11 Nov 2026
    20. bne IntelliNews — Foreign platforms drive growth on Hungary's €6bn e-commerce market (PwC E-toplist: HUF 2.1 trillion in 2025) · 19 Jun 2026
    21. EurobuildCEE — Hungarian industrial stock nears 6 mln sqm (Budapest Research Forum) · 24 Jul 2025
    22. Economx — The state in the cloud: Hungary reaches a digital milestone (DÁP ~2.5 million downloads; IdomSoft cloud use) · 18 Nov 2025
    23. Világgazdaság — New heads at DMÜ, DKÜ and NISZ; audit of state IT systems begins · 3 Jun 2026
    24. Euronews — EU Commission approves Hungary's revised €10bn recovery plan (€16.4B frozen funds agreement) · 19 Jun 2026
    25. CEE Legal Matters (Provaris Varga & Partners) — New cybersecurity laws in Hungary (Act LXIX and Act LXXXIV of 2024) · Dec 2024
    26. RSM Hungary — NIS2: modified cybersecurity deadlines (contracts 31 Aug 2025; audits 30 Jun 2026) · 19 Jun 2025
    27. Telex — SZTFH decree removes advantages in the cybersecurity audit market (Decree 6/2026; ~3,500 entities; 10 auditors) · 8 Jun 2026
    28. Bird & Bird — Hungary: priorities for 2026 (SZTFH and NKI powers; fines; first audits by 30 Jun 2026) · 2026
    29. Nemzeti Jogszabálytár — Act LXIX of 2024 on the cybersecurity of Hungary (English translation; sections 7, 8, 9, 16) · accessed 11 Nov 2026
    30. CMS — GDPR Enforcement Tracker Report: Hungary · 21 May 2026
    31. European Commission — Adequacy decisions (India not listed) · checked 11 Nov 2026
    32. EUR-Lex — Commission Implementing Decision (EU) 2021/914 on standard contractual clauses (Clause 14) · 4 Jun 2021
    33. Lewis Silkin — The EU Data Act: what's it for and what do I have to do? · 22 Sep 2025
    34. McCann FitzGerald — Cyber Resilience Act: reporting obligations apply from 11 September 2026 · 10 Sep 2026
    35. Garrigues — The European Digital Identity Wallet now has a timetable (eIDAS 2) · accessed 4 Nov 2026
    36. Mondaq — EU Digital Omnibus on AI enters into force (Regulation (EU) 2026/1744) · 3 Aug 2026
    37. Software Improvement Group — EU AI Act summary and timeline (incl. Omnibus) · updated 14 Aug 2026
    38. Digital Policy Alert — Act LXXV of 2025 on the implementation of the EU AI Regulation in Hungary enters into force · accessed 11 Nov 2026
    39. CMS — Hungary implements institutional framework for EU AI Act (Act LXXV of 2025; Decree 344/2025) · 6 Nov 2025
    40. Codozasady — DORA applies from 17 Jan 2025 (EU-wide) · 19 Dec 2024
    41. Magyar Nemzeti Bank — Recommendation 2/2025 (I.13.) on the use of community and public cloud services (Hungarian) · 13 Jan 2025
    42. PwC Worldwide Tax Summaries — Hungary: taxes on corporate income (CIT 9%; LBT up to 2%; innovation contribution 0.3%) · reviewed 1 Jul 2026
    43. PwC Worldwide Tax Summaries — Hungary: other taxes (VAT 27%, 18%, 5%, 0%) · reviewed 1 Jul 2026
    44. PwC Worldwide Tax Summaries — Hungary: withholding taxes · reviewed 1 Jul 2026
    45. Tax Foundation — VAT rates in Europe, 2026 (Hungary highest at 27%) · 26 Jan 2026
    46. Multilaw — Global Business Entities Guide: Hungary, limited liability company (Kft.) · accessed 11 Nov 2026
    47. Pound Sterling Live — USD/INR 2026 history (close 95.1675 on 26 Oct 2026) · accessed 5 Nov 2026
    48. Wise — USD to HUF rate history (323.264 on 18 Oct 2026) · accessed 11 Nov 2026
    49. Pound Sterling Live — Bank of England USD/EUR reference rates 2026 (0.8925 on 23 Oct 2026) · accessed 5 Nov 2026
    50. ENX Association — TISAX (automotive information security assessments; labels valid three years; VDA ISA) · accessed 11 Nov 2026
    51. Microsoft Windows Server Blog — Planning ahead for Windows Server 2016 end of support (12 Jan 2027) · accessed 4 Nov 2026
    52. DNSimple — SSL certificate validity changes 2026–2029 (CA/B Forum ballot SC081v3) · accessed 4 Nov 2026
    53. XpatLoop — Latest tax guide (Forvis Mazars) finds Hungary's tax regime is atypical in EU · 22 May 2025
    54. Kennedys — The European Health Data Space is in force (Reg. 2025/327) · 2026
    55. EUR-Lex — Directive (EU) 2022/2555 (NIS2), Annex I and II sectors · OJ L 333, 27 Dec 2022
    Disclaimer

    This is an internal and partner strategy briefing, not a public offer. It is not legal, tax, investment or financial advice. Market figures come from the cited third parties, which may use different scopes and methods. Law summaries are based on official and law-firm commentary available on 11 Nov 2026. EU and Hungarian rules are changing, including after the 2026 change of government, so check every point with qualified Hungarian counsel and tax advisers before any investment or contracting decision. Items marked "not re-verified" could not be confirmed from a primary source. Goals and revenue-model values are assumptions for discussion, not forecasts. XcellHost service pages describe the Indian offer; Hungarian delivery, hosting and pricing will be set with partners. Third-party names are used for identification only and do not imply partnership, customer relationships or endorsement.

    Other country strategies

    The same playbook, twenty-one markets

    Each briefing uses the same structure: sourced market size, ten verticals, laws, entry model and an editable revenue model.

    Europe overviewThe regional strategy this Hungary plan sits under: EU-wide laws, transfers to India and country prioritiesOpen →
    IndiaDPDP Act & Rules 2025, CERT-In, RBI / SEBI cyber rulesOpen → VietnamData localisation, PDPL and the 2025 Cybersecurity LawOpen → SingaporePDPA, Cybersecurity Act and the regional HQ roleOpen → IndonesiaPDP Law 2022, data localisation (PP 71/2019) and ASEAN scaleOpen → MalaysiaPDPA amendments, Cyber Security Act and Johor DCsOpen → UAEFederal PDPL, DIFC / ADGM regimes and AI strategyOpen → Saudi ArabiaPDPL, NCA controls and Vision 2030Open → KenyaData Protection Act and East Africa's digital hubOpen → RwandaPersonal data law and Kigali's tech-hub ambitionsOpen → GhanaData Protection Act 2012, Cybersecurity Act 2020 and West Africa hubOpen → NigeriaNDPA 2023, CBN cyber rules and Africa's largest marketOpen → TanzaniaPDPA 2022 and the digital economy strategyOpen → South AfricaPOPIA, Cybercrimes Act and the cloud policyOpen → PolandNIS2 (KSC), DORA and the EU AI ActOpen → HungaryGDPR + Infotv., NIS2 (Act LXIX of 2024) and CEE hubYou are here GermanyGDPR/BDSG, NIS2, BSI C5 and the EU AI ActOpen → UKUK GDPR, Data (Use and Access) Act and Cyber EssentialsOpen → USAState privacy laws, HIPAA, CMMC and SEC cyber rulesOpen → CanadaPIPEDA, Quebec Law 25 and OSFI B-13Open → AustraliaPrivacy Act reforms, SOCI and Essential EightOpen → New ZealandPrivacy Act 2020, NZISM and cloud-first policyOpen →