Law / Bulgaria

Personal Data Protection Act (Zakon za zashtita na lichnite danni, ZZLD)

Закон за защита на личните данни (ЗЗЛД) Obn. DV. br.1 ot 4 yanuari 2002 g., as amended (English: Personal Data Protection Act, State Gazette No. 1 of 4 January 2002, as amended)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 26 February 2019.

A comprehensive regime rule binding public and private bodies.

As of 24 August 2026.

What it requires

Establish a General Data Protection Regulation (GDPR) Article 6 lawful basis before processing personal data of a person in Bulgaria; the Act's own text is not confirmed, and any Bulgarian-specific addition to that basis is unverified.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Bulgaria gives the General Data Protection Regulation (GDPR) domestic effect through the Personal Data Protection Act (Закон за защита на личните данни, PDPA), originally promulgated 4 January 2002, predating the GDPR like Hungary's act though far less substantially rewritten, and substantially amended 26 February 2019 for GDPR alignment. The Act's primary text has not been located; every finding below rests on two commentary sources (CMS, DLA Piper).

When LexLint raises it

crawls_web
trains_models
generates_content
deploys_chatbot
automated_outreach
high_risk_decisions
processes_voice
processes_biometrics

Read the law

CMS and DLA Piper commentary only
cpdp.bg confirmed unreadable (JavaScript shell, not the document)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app