BulgariaPersonal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)
Закон за защита на личните данни (ЗЗЛД) Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of , as amended)
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Bulgaria.
These lines are LexLint's reading of the law's text. Also read by: Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria) (guidance, recorded ); Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252
- Guidance link
- https://cpdp.bg/%D0%BA%D0%BB%D1%8E%D1%87%D0%BE%D0%B2%D0%B8-%D0%B7%D0%B0%D0%B4%D1%8A%D0%BB%D0%B6%D0%B5%D0%BD%D0%B8%D1%8F-%D0%B7%D0%B0-%D0%B1%D0%B8%D0%B7%D0%BD%D0%B5%D1%81%D0%B0/
- Case citation
- Case C-252/21 Meta Platforms and Others (General terms of use of a social network), judgment of the Court of Justice of (Grand Chamber)
- Guidance body
- Комисия за защита на личните данни (Commission for Personal Data Protection, Bulgaria)
- Open questions
- Does the rule in Article 25g of the Personal Data Protection Act that an identity document may be copied only if a law provides for it also bar a copy taken with the holder's consent?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Event time, Actor identity, Access record
Logging duty
Article 63(1) requires a controller or processor running an automated processing system to keep system logs of collection, alteration, consultation, disclosure including transfer, combination and erasure, and Article 63(2) says what a consultation or disclosure entry must show. Article 62 adds a written register of processing categories that the controller gives the Commission or the Inspectorate on request. Both articles sit in the Act's part for competent authorities processing data to prevent and prosecute crime (Article 1(2)); the record duties of a private-sector controller come from the GDPR. Article 63(4) leaves the period for keeping the logs to the controller. Article 15(2) separately obliges the Commission to keep non-public registers of violations and of breach notifications.
- Kind
- Explicit
- As of
- Provision
- Article 63(1) (system logs of automated processing), with Article 62 (a register of processing activities)
- Trigger
- personal_data_processing
What this law does
Bulgaria gives the General Data Protection Regulation (GDPR) domestic effect through the Personal Data Protection Act (Закон за защита на личните данни, PDPA), originally promulgated and substantially amended for GDPR alignment by an act promulgated on .
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .