GDPR Article 9 and PDPA Employment and National-ID-Number Rules

Regulation (EU) 2016/679, Art. 9; PDPA (ЗЗЛД), employment and ЕГН provisions

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Commencement not set.

A sensitive categories rule binding public and private bodies.

As of 24 August 2026.

What it requires

Obtain an explicit General Data Protection Regulation (GDPR) Article 9(2) legal basis before processing biometric, health, or other special-category personal data of a person in Bulgaria.
Do not use the Bulgarian national identification number (ЕГН) as a sole service identifier, and grant public access to it only where required by law, per commentary describing the PDPA; verify against the Act's own text before relying on it.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category.

Two commentary sources agree Bulgaria has not adopted a distinct biometric restriction beyond GDPR; the Act's own additions described in commentary sit instead in employment data (identification-document copies only if required by law, criminal-background-check information only under explicit legal authorization rather than consent or legitimate interest, a 6-month recruitment-data retention cap) and in protecting the Bulgarian national identification number (ЕГН, Edinen grazhdanski nomer, Unified Civil Number, English: EGN): public access only if required by law, with technical measures required to prevent its use as a sole service identifier.

None of this is independently verified against the Act's own text. No commencement date is recorded for this instrument: no primary-source text was read and this rests entirely on commentary, so the status here is enacted rather than in force, rather than an asserted but unconfirmed effective date.

When LexLint raises it

processes_biometrics
processes_voice
high_risk_decisions

Read the law

CMS and DLA Piper commentary
the Act's own text is not reproduced

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app