Bulgaria

GDPR Articles 33-34, Breach Notification

A controller must notify KZLD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Commentary adds a procedural detail, that KZLD maintains non-public breach registers and approved notification templates in Bulgarian only, which is a procedural addition rather than a substantive derogation from the 72-hour standard; no primary text was read.

Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)

Bulgaria gives the General Data Protection Regulation (GDPR) domestic effect through the Personal Data Protection Act (Закон за защита на личните данни, PDPA), originally promulgated 4 January 2002, predating the GDPR like Hungary's act though far less substantially rewritten, and substantially amended 26 February 2019 for GDPR alignment.

This session could not read the Act's primary text: cpdp.bg, the Bulgarian data protection commission's own site, served only WordPress and emoji-polyfill JavaScript to a direct fetch and to a crawler-based reader, confirmed on repeated attempts. Every finding below rests on two commentary sources (CMS, DLA Piper) rather than a primary-source read.

GDPR Chapter V, Cross-Border Transfer Restrictions

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. DLA Piper's commentary states no Bulgarian derogations exist and General Data Protection Regulation (GDPR) Articles 44-49 apply directly without modification; no primary text was read.

GDPR Articles 12-22, Data-Subject Rights

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. No Bulgaria-specific derogation was found beyond the employment and national-ID-number rules described above, per two commentary sources; no primary text was read.

KZLD Enforcement and GDPR Article 82

Комисия за защита на личните данни (KZLD, English: Commission for Personal Data Protection) is Bulgaria's supervisory authority; an Inspectorate with the Supreme Judicial Council holds a parallel, narrower oversight role whose exact scope was not established in this pass. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.

Commentary describes a Bulgarian procedural avenue, a complaint to KZLD within 6 months of discovering a violation or a direct administrative court claim, mutually exclusive where Commission proceedings on the same matter are already pending; this is an administrative-enforcement and judicial-review structure rather than a distinct civil damages remedy beyond Article 82, and is recorded here as procedural rather than folded into the private-right-of-action finding's basis.

GDPR Article 9 and PDPA Employment and National-ID-Number Rules

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category.

Two commentary sources agree Bulgaria has not adopted a distinct biometric restriction beyond GDPR; the Act's own additions described in commentary sit instead in employment data (identification-document copies only if required by law, criminal-background-check information only under explicit legal authorization rather than consent or legitimate interest, a 6-month recruitment-data retention cap) and in protecting the Bulgarian national identification number (ЕГН, Edinen grazhdanski nomer, Unified Civil Number, English: EGN): public access only if required by law, with technical measures required to prevent its use as a sole service identifier.

None of this was independently verified against the Act's own text this session. No commencement date is recorded for this instrument: this document rests entirely on commentary with no primary-source text read, and status is downgraded from in_effect to enacted rather than asserting an unconfirmed effective date.