Duty LXD-0871
Processes personal data, in Bulgaria
GDPR Article 9 and PDPA Employment and National-ID-Number Rulessince 2 lines
Regulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions · Read the law's page
- Obtain an explicit GDPR Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in Bulgaria.
- Do not let the Bulgarian national identification number (ЕГН) be the only means of identifying a user of a remote electronic service, and do not allow free public access to information containing it unless a law provides otherwise.
GDPR Articles 12-21 and Personal Data Protection Act Articles 37a-37v, Data Subject Rights in Bulgariasince 3 lines
Regulation (EU) 2016/679, Arts. 12-21; Zakon za zashtita na lichnite danni, Arts. 37a-37v · Read the law's page
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Bulgaria within one month of receipt.
- You may refuse, wholly or partly, to give effect to a person's rights in Bulgaria where doing so would create a risk for an interest Article 37a lists, such as the rights and freedoms of others or the enforcement of a civil-law claim, with the conditions and procedure that law sets in line with GDPR Article 23(2), under Personal Data Protection Act Article 37a.
- Accept a rights request from a person in Bulgaria made in writing, electronically, or through an action in your product's interface once the person is identified, under Personal Data Protection Act Articles 37b and 37v.
GDPR Articles 33-34, Breach Notificationsince 2 lines
Regulation (EU) 2016/679, Arts. 33-34 · Read the law's page
- Notify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Bulgaria, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
GDPR Chapter V, Cross-Border Transfer Restrictionssince 1 line
Regulation (EU) 2016/679, Arts. 44-49 · Read the law's page
- Rely on an adequacy decision, Standard Contractual Clauses, Binding Corporate Rules, or a narrow Article 49 derogation before moving personal data of a person in Bulgaria outside the EEA.
KZLD Enforcement and GDPR Article 82since 1 line
Regulation (EU) 2016/679, Arts. 82-83 · Read the law's page
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under GDPR Article 82.
Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)since 1 line
Закон за защита на личните данни (ЗЗЛД), Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of , as amended) · Read the law's page
- Establish a GDPR Article 6 lawful basis before processing personal data of a person in Bulgaria.