BulgariaGDPR Articles 33-34, Breach Notification
Regulation (EU) 2016/679, Arts. 33-34
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Notify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach affecting a person in Bulgaria, unless the breach is unlikely to risk their rights and freedoms, and notify affected individuals without undue delay where the breach is likely to result in a high risk to them.
- If you process personal data on behalf of a controller, notify the controller without undue delay after becoming aware of a personal data breach (Article 33(2)).
These lines are LexLint's reading of the law's text. Also read by: Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://cpdp.bg/home-default/%D0%BF%D0%BE%D0%BB%D0%B5%D0%B7%D0%BD%D0%B0-%D0%B8%D0%BD%D1%84%D0%BE%D1%80%D0%BC%D0%B0%D1%86%D0%B8%D1%8F/%D0%B4%D0%B5%D0%B9%D1%81%D1%82%D0%B2%D0%B8%D1%8F-%D0%BD%D0%B0-%D0%B0%D0%B4%D0%BC%D0%B8%D0%BD%D0%B8%D1%81%D1%82%D1%80%D0%B0%D1%82%D0%BE%D1%80%D0%B8%D1%82%D0%B5-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%87%D0%BD/
- Guidance body
- Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria)
- Open questions
- Which law sets the conditions and procedure under which a controller may decline the notice to affected persons required by Article 34 of Regulation (EU) 2016/679, where Article 37a(1) of the Personal Data Protection Act permits it for a listed risk?
What it makes you log
Who may demand the log
Regulator
Logging duty
Article 33(5) requires the controller to document every personal data breach, whether or not it is notified, covering the facts, its effects and the remedial action taken. Those three items are outside the closed list of log contents. The notification rules in Articles 33(1) to (4) and 34 are reports, not records. Article 15(2) of the Personal Data Protection Act separately obliges the Commission to keep a non-public register of the breach notifications it receives.
- Kind
- Explicit
- As of
- Provision
- Article 33(5) (the controller documents every personal data breach)
- Trigger
- security_incident
What this law does
A controller must notify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.
Article 37a(1) of the Act also lets a controller decline to give that notice to the individual where giving it would create a risk for a listed interest, such as national security or another person's rights and freedoms. The Act directs the Commission for Personal Data Protection to keep a non-public register of the notifications of personal-data breaches made under General Data Protection Regulation (GDPR) Article 33 (Article 15(2)).
The Act repeats the 72-hour deadline in Article 67(1) for competent authorities processing for criminal-justice purposes. KZLD publishes a notification form for GDPR Article 33 and Article 67 of the Act.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .