BulgariaElectronic Communications Act Articles 261в to 261д, Personal Data Breach Notification by Providers of Public Electronic Communications Services
Zakon za elektronnite saobshtenia (Закон за електронните съобщения), чл. 261в-261д
In force since .
A breach notification rule binding public and private bodies.
- Obligation class
- Breach notice
As of .
What it requires
- If you provide public electronic communications services, notify the KZLD within three days of establishing a personal data breach (Electronic Communications Act Article 261в, paragraph 1).
- Promptly notify the affected user or other person where the breach may adversely affect their personal data or privacy, unless you have shown the KZLD that appropriate technological protection measures were applied to the data concerned (Article 261в, paragraphs 2 and 3).
- In the notice, describe at least the nature of the breach, give contact points and recommend mitigating measures, and add the consequences and the remedial measures you proposed or took in the notice to the KZLD (Article 261в, paragraphs 5 and 6).
- Keep a register of personal data breaches that records the facts, their consequences and the action taken (Article 261д).
Who enforces it
Enforcement body
Commission for Personal Data Protection (KZLD), which may check providers' compliance with the notification duty and impose sanctions for failure to notify.
What this law does
A provider of public electronic communications services must notify the Commission for Personal Data Protection (KZLD) within three days of establishing a personal data breach. The provider must also promptly notify the affected user or other person where the breach may adversely affect personal data or privacy. That notice may be omitted where the provider has shown the KZLD that it applied appropriate technological protection measures to the data concerned.
The KZLD may order a provider that has not notified the person to do so. The notice describes at least the nature of the breach, the contact points and recommended mitigating measures, and the notice to the KZLD also describes the consequences and the remedial measures proposed or taken. Providers must keep a register of breaches that records the facts, the consequences and the action taken.
When LexLint raises it
When your app profile says your app provides telecom services.