Bulgaria

A controller must notify KZLD within 72 hours of becoming aware of a personal-data breach, and notify the affected individual without undue delay where the breach is likely to result in a high risk. Commentary adds a procedural detail, that KZLD maintains non-public breach registers and approved notification templates in Bulgarian only, which is a procedural addition rather than a substantive derogation from the 72-hour standard; no primary text was read.

Bulgaria gives the General Data Protection Regulation (GDPR) domestic effect through the Personal Data Protection Act (Закон за защита на личните данни, PDPA), originally promulgated 4 January 2002, predating the GDPR like Hungary's act though far less substantially rewritten, and substantially amended 26 February 2019 for GDPR alignment. The Act's primary text has not been located; every finding below rests on two commentary sources (CMS, DLA Piper).

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. DLA Piper's commentary states no Bulgarian derogations exist and General Data Protection Regulation (GDPR) Articles 44-49 apply directly without modification; no primary text was read.

General Data Protection Regulation (GDPR) Articles 12-22 apply directly. No Bulgaria-specific derogation was found beyond the employment and national-ID-number rules described above, per two commentary sources; no primary text was read.

Комисия за защита на личните данни (KZLD, English: Commission for Personal Data Protection) is Bulgaria's supervisory authority; an Inspectorate with the Supreme Judicial Council holds a parallel, narrower oversight role whose exact scope is not established. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.

Commentary describes a Bulgarian procedural avenue, a complaint to KZLD within 6 months of discovering a violation or a direct administrative court claim, mutually exclusive where Commission proceedings on the same matter are already pending; this is an administrative-enforcement and judicial-review structure rather than a distinct civil damages remedy beyond Article 82, and is recorded here as procedural rather than folded into the private-right-of-action finding's basis.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category.

Two commentary sources agree Bulgaria has not adopted a distinct biometric restriction beyond GDPR; the Act's own additions described in commentary sit instead in employment data (identification-document copies only if required by law, criminal-background-check information only under explicit legal authorization rather than consent or legitimate interest, a 6-month recruitment-data retention cap) and in protecting the Bulgarian national identification number (ЕГН, Edinen grazhdanski nomer, Unified Civil Number, English: EGN): public access only if required by law, with technical measures required to prevent its use as a sole service identifier.

None of this is independently verified against the Act's own text. No commencement date is recorded for this instrument: no primary-source text was read and this rests entirely on commentary, so the status here is enacted rather than in force, rather than an asserted but unconfirmed effective date.

Unlawfully accessing an information system or a part of it, in a case that is not immaterial, carries imprisonment of up to two years. Where two or more people acted by prior agreement, the punishment rises to imprisonment of up to two years plus a fine of up to BGN 3,000. Where the act is repeated, or targets data for creating an electronic signature, the punishment rises to imprisonment of up to three years plus a fine of up to BGN 5,000.

Where the information is a state secret or otherwise legally protected, the punishment is imprisonment of one to three years. Where grave consequences result, the punishment is imprisonment of one to eight years. The provision's own text does not condition the offense on defeating a security measure, unlike Spain's equivalent Article 197 bis of the Codigo Penal.

A person with lawful access to a work or other protected subject matter may reproduce it, or extract or reuse a database, without the rightsholder's consent or payment, for the purposes of automated text-and-data analysis, per Article 26e(1) and (2).

A rightsholder may prohibit that use, and for content made available online the prohibition is effective only where established by technical means recognizable by the software performing the analysis, per Article 26e(4), which is the opt-out a crawler must honor.

A separate, unconditional exception in Article 26zh(1) and (3) covers universities, libraries and research and scientific institutes performing automated text-and-data analysis for scientific research, without the Article 26e(4) opt-out. Where a research user under Article 26zh has requested access, the rightsholder must provide it within 72 hours, per Article 26k(2).

Article 22 of the Cybersecurity Act, as substituted by Paragraph 26 of the amending Act, requires every essential and important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses in its core activity or in providing its services, at a level of security matched to the entity's exposure, size, and the likelihood and severity of an incident.

The measures must follow an all-hazards approach covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures, business continuity (including backup and disaster-recovery management and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the risk-management measures themselves, basic cyber-hygiene practices and cybersecurity training, cryptography and encryption policies, and human-resources security and access control.

Article 21, as substituted by Paragraph 25 of the same amending Act, puts approval and oversight of these Article 22 measures on the entity's own management body (or, for an administrative body, its governing organ), and separately requires every management-body member of an essential or important entity to complete cybersecurity training every two years sufficient to identify risks and assess risk-management practices, and to organise the same training for the entity's staff.

Both articles transpose NIS2 Articles 20 and 21 respectively, and apply, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform, which the amended annex lists among the reached digital service providers.

Article 23 of the Cybersecurity Act, as substituted by Paragraph 27 of the amending Act, requires every essential and important entity to notify СЕРИКС of every significant incident. СЕРИКС is the sectoral Computer Security Incident Response Team the Act defines at Art. 18(1). The notification runs on a graduated clock.

An early warning is due within 24 hours of becoming aware of the incident, stating where applicable whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect. An incident notification is due within 72 hours, updating that assessment with an initial severity and impact evaluation, or within 24 hours instead of 72 where the notifying entity is a trust service provider. An interim report is due on СЕРИКС's request.

A final report is due no later than one month after the incident notification, covering the incident's scope and impact, the likely threat type or cause, the mitigation measures applied and ongoing, and any cross-border effect. Where the entity has not resolved the incident by the one-month mark, it files an interim report instead and a final report within one month of resolving it.

Where appropriate and without undue delay, the entity must also notify the recipients of its service of a significant incident likely to adversely affect them and of any measures or safeguards they can take, and of a significant cyber threat and its nature; notification to recipients may be delayed, with the competent authority's consent, where it would jeopardise the incident's investigation. СЕРИКС must acknowledge the early warning within 24 hours, except where objectively impossible, and, on request, provide operational guidance or further technical support.

This article transposes NIS2 Article 23, and applies, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform.

A media service provider must not create or distribute programs that could harm a child's physical, psychological, moral or social development, per Article 17a(1). The Council for Electronic Media adopts a Code of Conduct with providers, including the public broadcasters BNT and BNR, prescribing measures such as scheduling, age-verification tools and encoding to assess, label and restrict access to harmful programs, per Article 17a(3) and (4).

Since the 2020 transposition of the amended AVMSD, a video-sharing platform provider must take appropriate measures, including age-verification systems, to protect children from user-generated videos and audio-visual commercial communications that could harm their development, alongside signalling, parental-control, and media-literacy measures, per Article 19d. A media service provider that violates Article 17a(1) is subject to a property sanction of BGN 15,000 to 30,000, doubled on a repeat violation.

A press publication publisher holds the exclusive right to license, for payment, an information-society service provider's online reproduction of its press publications or parts of them, and the offer of electronic access to them, per Article 90d(1). The right does not apply to an individual's personal or non-commercial use, reproduction of the facts reported, the use of single words or very short extracts, or the creation of hyperlinks, per Article 90d(2). The right lasts two years from first publication, running from the following 1 January, per Article 90zh.

A person with lawful access to a work, including a press publication, may reproduce it or extract data from it for automated text-and-data analysis without the rightsholder's consent, per Article 26e(1).

A rightsholder, including a press publisher, may reserve that use by a machine-readable technical means, such as a robots.txt-style signal, which is binding once so established, per Article 26e(4); a news aggregator indexing press content must honor that reservation to remain within the exception.

A separate, unconditional exception in Article 26zh covers universities, libraries and research institutes mining for scientific research, and Article 26k(2) obliges a rightsholder to give such a research user access within 72 hours of a request.