BulgariaGDPR Articles 12-21 and Personal Data Protection Act Articles 37a-37v, Data Subject Rights in Bulgaria
Regulation (EU) 2016/679, Arts. 12-21; Zakon za zashtita na lichnite danni, Arts. 37a-37v
In force since .
A data subject rights rule binding public and private bodies.
- Audit expectation
- none
What it requires
- Honor a person's request to access, rectify, erase, restrict, port, or object to processing of their personal data in Bulgaria within one month of receipt.
- You may refuse, wholly or partly, to give effect to a person's rights in Bulgaria where doing so would create a risk for an interest Article 37a lists, such as the rights and freedoms of others or the enforcement of a civil-law claim, with the conditions and procedure that law sets in line with General Data Protection Regulation (GDPR) Article 23(2), under Personal Data Protection Act Article 37a.
- Accept a rights request from a person in Bulgaria made in writing, electronically, or through an action in your product's interface once the person is identified, under Personal Data Protection Act Articles 37b and 37v.
These lines are LexLint's reading of the law's text. Also read by: Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria) (guidance, recorded ); Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0487
- Guidance link
- https://cpdp.bg/%D0%BA%D0%BB%D1%8E%D1%87%D0%BE%D0%B2%D0%B8-%D0%B7%D0%B0%D0%B4%D1%8A%D0%BB%D0%B6%D0%B5%D0%BD%D0%B8%D1%8F-%D0%B7%D0%B0-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81%D0%B0/
- Case citation
- Case C-487/21 F.F. v Österreichische Datenschutzbehörde and CRIF, judgment of the Court of Justice of (First Chamber)
- Guidance body
- Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria)
- Open questions
- Does Article 37a(2) of the Personal Data Protection Act, which leaves the conditions and procedure for refusing the rights in Articles 12 to 22 of Regulation (EU) 2016/679 to a law, satisfy the requirement of Article 23(2) of that Regulation that the legislative measure itself contain specific provisions?
What it makes you log
Logging duty
Articles 12 to 21 set response periods for data-subject requests, and Articles 37a, 37b and 37v of the Personal Data Protection Act allow a refusal on listed grounds and set how a request is made. None of them requires a log or a record.
- Kind
- None
- As of
What this law does
Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Bulgaria can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.
Bulgaria's Personal Data Protection Act lets a controller refuse, wholly or partly, to give effect to the rights in GDPR Articles 12 to 22 where exercising them would create a risk for a listed interest, including another person's rights and freedoms or the enforcement of a civil-law claim, with the conditions and procedure to be set by law in line with GDPR Article 23(2) (Article 37a).
It also sets how a request is made: in writing, electronically, or through an action in the system's own user interface once the person is identified, with the content Article 37v lists (Articles 37b and 37v).
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .