When registering a domain, you must provide the details of the domain holder and the contact persons (name, address, email address, telephone number). Registries publish some of this information in the public WHOIS database, which anyone can search. The purpose of domain privacy (WHOIS privacy) is to ensure that personal data does not appear in these public searches.

What information is displayed for a domain?

The following is always public, regardless of data protection regulations:

• the domain name and its status (e.g. active, locked, expired);
• the registration and expiry dates;
• the registrar’s name and contact details;
• a’s domain name servers.

The details of the domain holder and contact persons are either visible or hidden, depending on the domain extension and the type of domain holder.

How does hiding work?

There are two options:

• Redaction: the registry simply does not display the personal data; instead, text such as ‘REDACTED FOR PRIVACY’ appears in its place. This has been the most common practice since the GDPR came into force.
• Proxy data: the public records display the general details of the registrar or a data protection service provider, and correspondence relating to the domain is forwarded to the domain holder via a forwarding address.

In both cases, the actual data remains with the registrar and the registry. The domain holder remains responsible for the domain, and the data may be disclosed where there is a legitimate interest (for example, in response to a request from a public authority or when a breach of the law is reported).

GDPR and WHOIS

The General Data Protection Regulation (GDPR) has been in force since 2018, and since then most registries and registrars have, by default, refrained from publishing the personal data of private individuals. In the case of companies and organisations, the organisation’s name is generally still visible, as this does not constitute personal data. However, an email address that includes an employee’s name kovacs.janos@pelda.hu is personal data, so it is advisable to use a generic address info@pelda.hu even for a company domain.

How are the different domain extensions handled?

• .hu: According to the Domain Registration Regulations, the domain holder’s name, telephone number and email address are only displayed if they do not contain any personal data. The details of private individuals are therefore always hidden, and this cannot be changed; the details of companies, however, are public (see the .hu domain page).
• .eu: a separate WHOIS privacy service is not available, but private individuals’ data is concealed in accordance with the GDPR.
• .com and other generic top-level extensions: WHOIS privacy is generally available to both individuals and companies; in such cases, only the domain holder’s country remains visible.
• The regulations for certain country code extensions exclude or restrict privacy (for example, the US .us extension does not allow it). You can find the rules for a specific extension in the ‘Whois privacy’ section on the extension’s page.

When registering a domain with us, WHOIS privacy is provided free of charge where the extension permits it.

What should you look out for?

• The details must be accurate even when hidden. The registry may suspend or delete the domain due to false or out-of-date details, and in the event of a dispute, it will be difficult to prove that the domain belongs to you.
• The email address must be valid. This is where expiry notifications, verification and confirmation emails are sent, for example, during a transfer.
• Privacy protection does not shield you from everything. The domain name, name servers and expiry date remain public, and WHOIS privacy does not hide the contact details published on the website (such as the mandatory legal notice).