Handles health records, in Bulgaria

Закон за киберсигурност (ЗКС), чл. 21 и 22, изм. с §§ 25 и 26 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 21 and 22, as substituted by §§ 25 and 26 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems you use in your core activity or in providing your services, sized to your exposure, your size, and the likelihood and severity of an incident.
• Cover, at minimum: risk-analysis and information-system-security policies, incident-handling procedures, business-continuity and backup management, supply-chain security, security in the acquisition, development and maintenance of your systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of your own risk-management measures, basic cyber-hygiene practices and training, cryptography and encryption policies, human-resources security, access control and asset management, multi-factor or continuous authentication with secured communications and emergency communication systems where appropriate, change management of information assets, and the risk-management and reporting measures that apply to entities of the kind named in Annex I or II and to critical entities under Directive (EU) 2022/2557.
• Have your management body approve and oversee these measures, and have every member of your management body complete cybersecurity training every two years and organise the same training for your staff; a member who fails to do so faces a personal fine of EUR 500 to 5,000.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8. Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform, so such a provider is reached on those terms; the wider sector classes the Act reaches (energy, transport, banking, health, drinking water, digital infrastructure, public administration, manufacturing and others) are reached on the same terms.

Закон за киберсигурност (ЗКС), чл. 23, изм. с § 27 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Art. 23, as substituted by § 27 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Notify СЕРИКС of every significant incident on this clock: an early warning within 24 hours of detecting the significant incident, an incident notification within 72 hours of detecting it (24 hours if you are a trust service provider), an interim report on request, and a final report no later than one month after the incident notification (or, if you have not dealt with the incident by then, an interim report followed by a final report within one month after you have finished handling it) (Article 23(5)).
• State in your early warning, where applicable, whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect; update that assessment with an initial severity and impact evaluation in your 72-hour notification; and cover in your final report the incident's scope and impact, its likely cause, your mitigation measures, and any cross-border effect.
• Where appropriate and without undue delay, notify the recipients of your service of a significant incident likely to adversely affect them and of any measures they can take, and of a significant cyber threat and its nature.
• Same penalty tier as the risk-management duty above: up to EUR 10,000,000 or 2 percent of worldwide turnover for an essential entity (not less than EUR 25,000), up to EUR 7,000,000 or 1.4 percent for an important entity (not less than EUR 12,500); this turnover-based sanction does not reach an essential entity that is itself an administrative body.
• This binds you where you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, which for an Annex I or II entity means at least a medium-sized enterprise unless an Article 4, point 3 case applies, as the national competent authority determines under Article 16(3), pt. 8; Annex II names a provider of an online marketplace, an online search engine, or a social networking services platform among the digital service providers it reaches expressly; the wider sector classes are reached as on this jurisdiction's companion risk-management-and-governance row.

Закон за киберсигурност (ЗКС), чл. 24 и 27, изм. с §§ 28 и 31 от Закона за изменение и допълнение на ЗКС, обн. ДВ, бр. 17 от 13.02.2026 г. (English: Cybersecurity Act, Arts. 24 and 27, as replaced by §§ 28 and 31 of the Act Amending and Supplementing the Cybersecurity Act, State Gazette No. 17 of 13 February 2026) · Read the law's page

• Where a Council of Ministers decree under Article 24 requires it, use the specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.
• Stop using a technology that a Council of Ministers decree restricts under Article 27(1) within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high (Article 27(2)).
• If you are an essential or important entity under Articles 4 and 4a of the Cybersecurity Act, including a provider of an online marketplace, an online search engine or a social-networking-services platform, these provisions bind you; the wider sector classes the Act reaches are reached too on the same terms: an entity of a kind named in Annex I or II that is at least a medium-sized enterprise, or that falls within one of the Article 4, point 3 cases whatever its size, as the national competent authority determines under Article 16(3), pt. 8.