Bulgaria

Decision No. 398 of the Council of Ministers is headed as determining national authorities for the protection of fundamental rights, including the right to non-discrimination, under Article 77 of Regulation (EU) 2024/1689. The Council of Ministers' portal records the Decision as number 398 of 2025, issued on 18 June 2025 and published on 19 June 2025, on the proposal of the Ministry of Electronic Governance, with Article 77(2) of the Regulation as its legal basis.

The Ministry of Electronic Governance stated on 28 July 2025 that by the Decision the Council of Ministers determined the national authorities for the protection of fundamental rights, including the right to non-discrimination.

Under point 1 of the Decision, as the Ministry stated it, the authorities are those that supervise or ensure compliance with the duties under Union law protecting fundamental rights, including non-discrimination, in relation to the use of the high-risk AI systems listed in Annex III to the Regulation.

The Ministry named the Ombudsman, the Central Election Commission, the Commission for Protection against Discrimination, the Commission for Personal Data Protection, the Consumer Protection Commission, the State Agency for Child Protection and the General Labour Inspectorate Executive Agency, each acting within its statutory powers.

A provider of public electronic communications services must notify the Commission for Personal Data Protection (KZLD) within three days of establishing a personal data breach. The provider must also promptly notify the affected user or other person where the breach may adversely affect personal data or privacy. That notice may be omitted where the provider has shown the KZLD that it applied appropriate technological protection measures to the data concerned.

The KZLD may order a provider that has not notified the person to do so. The notice describes at least the nature of the breach, the contact points and recommended mitigating measures, and the notice to the KZLD also describes the consequences and the remedial measures proposed or taken. Providers must keep a register of breaches that records the facts, the consequences and the action taken.

A controller must notify KZLD without undue delay, and within 72 hours where feasible, after becoming aware of a personal-data breach, unless the breach is unlikely to result in a risk to people's rights and freedoms, and must notify the affected individual without undue delay where the breach is likely to result in a high risk.

Article 37a(1) of the Act also lets a controller decline to give that notice to the individual where giving it would create a risk for a listed interest, such as national security or another person's rights and freedoms. The Act directs the Commission for Personal Data Protection to keep a non-public register of the notifications of personal-data breaches made under General Data Protection Regulation (GDPR) Article 33 (Article 15(2)).

The Act repeats the 72-hour deadline in Article 67(1) for competent authorities processing for criminal-justice purposes. KZLD publishes a notification form for GDPR Article 33 and Article 67 of the Act.

Bulgaria gives the General Data Protection Regulation (GDPR) domestic effect through the Personal Data Protection Act (Закон за защита на личните данни, PDPA), originally promulgated 4 January 2002 and substantially amended for GDPR alignment by an act promulgated on 26 February 2019.

A transfer of personal data outside the EEA requires an adequacy decision, appropriate safeguards, or a narrow Article 49 derogation, backed by the Article 83(5)(c) top fine tier. The Act's own rules on transfer to a third country, in Article 72 and the articles that follow it, bind competent authorities processing personal data for criminal-justice purposes.

General Data Protection Regulation (GDPR) Article 22 gives a person in Bulgaria the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects them, unless the decision is necessary for a contract with them, authorised by a law that safeguards their rights, or based on their explicit consent.

Where it rests on a contract or consent, the controller must at least let the person obtain human intervention, express their point of view and contest the decision.

Under Article 22(4), such a decision may not rest on the special categories of personal data in Article 9(1) unless the person gave explicit consent or the processing is necessary for reasons of substantial public interest on the basis of proportionate Union or Member State law, with suitable safeguards in place.

Articles 13(2)(f), 14(2)(g) and 15(1)(h) require the controller to tell the person that such decision-making takes place, with meaningful information about the logic involved and its significance and envisaged consequences for them, at collection, within the Article 14(3) period where the data came from another source, and on an access request.

Article 37a of the Personal Data Protection Act reaches this right too: a controller may refuse to give effect to it where doing so would endanger a listed interest, such as another person's rights and freedoms or the enforcement of a civil-law claim.

Under General Data Protection Regulation (GDPR) Articles 12 to 21, a person in Bulgaria can ask a controller for access to their personal data and for its rectification, erasure, restriction or portability, or object to its processing, and the controller must answer within one month, a period it may extend by two further months for complex or numerous requests.

Bulgaria's Personal Data Protection Act lets a controller refuse, wholly or partly, to give effect to the rights in GDPR Articles 12 to 22 where exercising them would create a risk for a listed interest, including another person's rights and freedoms or the enforcement of a civil-law claim, with the conditions and procedure to be set by law in line with GDPR Article 23(2) (Article 37a).

It also sets how a request is made: in writing, electronically, or through an action in the system's own user interface once the person is identified, with the content Article 37v lists (Articles 37b and 37v).

Комисия за защита на личните данни (KZLD, English: Commission for Personal Data Protection) is Bulgaria's supervisory authority; the Inspectorate with the Supreme Judicial Council supervises compliance when the courts, the prosecution and the investigating bodies process personal data in their judicial functions (Article 17(1)). General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.

Under Article 38(1) of the Act a data subject may refer a violation to KZLD within 6 months of learning of it and no later than two years after it was committed. Under Article 39 a data subject may instead challenge the acts of a controller or processor before the court under the Administrative Procedure Code and claim compensation in those proceedings. A data subject cannot go to court while proceedings on the same violation are pending before KZLD.

General Data Protection Regulation (GDPR) Article 9(1) treats biometric data processed for unique identification as a special category. Apart from a definition that refers to GDPR Article 4(14), the only provision of the Act that names biometric data is Article 51. It sits in the chapter for competent authorities processing personal data for criminal-justice purposes.

The Act's own additions sit instead in employment data and in protecting the Bulgarian national identification number (ЕГН, Edinen grazhdanski nomer, Unified Civil Number, English: EGN). A controller may copy an identity document, a driving licence or a residence document only if a law provides for it (Article 25g). An employer sets a retention period for the personal data of recruitment candidates of no more than 6 months, unless the candidate consents to a longer period (Article 25k).

Free public access to information containing the ЕГН is not permitted unless a law provides otherwise (Article 25zh(1)). A controller providing services electronically takes technical and organisational measures so that the ЕГН is not the only means of identifying a user of a remote service (Article 25zh(2)).

Unlawfully accessing an information system or a part of it, in a case that is not immaterial, carries imprisonment of up to six years and a fine of up to BGN 3,000. Where two or more people acted by prior agreement, the punishment is imprisonment of up to six years and a fine of up to BGN 5,000. Where the act is repeated, or targets data for creating an electronic signature, the punishment rises to imprisonment of up to seven years and a fine of up to BGN 20,000.

Where the information is a state secret or otherwise legally protected, or the system is part of critical infrastructure, the punishment is imprisonment of four to eight years, unless a heavier punishment applies. Where grave consequences result, the punishment is imprisonment of five to twelve years. Article 319a was added in 2002 and its first paragraph was amended in 2007, 2017 and 2022.

Unlawfully adding, copying, using, changing, transferring, deleting, damaging, degrading, hiding or destroying computer data in an information system, or stopping access to such data, in a case that is not immaterial, carries imprisonment of up to six years and a fine of up to BGN 10,000. Where the act causes significant harm or other grave consequences, the punishment is imprisonment of up to seven years and a fine of up to BGN 20,000.

Where the act is committed for financial gain, the punishment is imprisonment of five to seven years and a fine of up to BGN 10,000. Where it is committed through a computer program, password, access code or other access data meant to affect more than one information system and those grave consequences occur, the punishment is imprisonment of five to eight years and a fine of up to BGN 20,000.

Where it is committed on the order of an organized criminal group or against a critical-infrastructure information system, the punishment is imprisonment of nine to twelve years and a fine of up to BGN 30,000. Article 319b was added in 2002 and its first paragraph was amended in 2007, 2017 and 2022.

A person with lawful access to a work or other protected subject matter may reproduce it, or extract or reuse a database, without the rightsholder's consent or payment, for the purposes of automated text-and-data analysis, per Article 26e(1) and (2).

A rightsholder may prohibit that use, and for content made available online the prohibition is effective only where established by technical means recognizable by the software performing the analysis, per Article 26e(4), which is the opt-out a crawler must honor.

A separate exception in Article 26zh(1) and (3) covers universities and their libraries, scientific and research institutes, hospitals that conduct research, publicly accessible libraries, museums and archives, film and sound heritage institutions, and certain research organizations, performing automated text-and-data analysis for scientific research. Article 26zh is not limited by Article 26e, so the Article 26e(4) prohibition does not restrict it.

Article 26zh(4) excludes organizations controlled by a merchant that can have privileged access to the results of the research. Where a research user under Article 26zh has requested access, the rightsholder must provide it within 72 hours, per Article 26k(2).

Article 24 of the Cybersecurity Act, as replaced by Paragraph 28 of the Amending Act promulgated in State Gazette issue 17 of 13 February 2026, lets the Council of Ministers, on the Cybersecurity Council's proposal, require essential and important entities by decree to use specific ICT products, services and processes certified under a European cybersecurity certification scheme adopted under Article 49 of Regulation (EU) 2019/881, to show compliance with the Article 22 risk-management measures.

Article 27(1), as replaced by Paragraph 31, has the Cybersecurity Council propose to the Council of Ministers a decree restricting the use by the entities under Articles 4 and 4a of specific technologies or critical ICT supply chains. Under Article 27(2), an entity that already uses a technology such a decree restricts must stop using it within three years of the decree's adoption, or within the shorter period the decree sets where the risk to national security is high.

Article 22 of the Cybersecurity Act, as substituted by Paragraph 26 of the amending Act, requires every essential and important entity to take appropriate and proportionate technical, operational and organisational measures to manage the risks to the security of the network and information systems it uses in its core activity or in providing its services, at a level of security matched to the entity's exposure, size, and the likelihood and severity of an incident.

The measures must follow an all-hazards approach covering, at minimum, risk-analysis and information-system-security policies, incident-handling procedures, business continuity (including backup and disaster-recovery management and crisis management), supply-chain security, security in the acquisition, development and maintenance of network and information systems including vulnerability handling and disclosure, policies to evaluate the effectiveness of the risk-management measures themselves, basic cyber-hygiene practices and cybersecurity training, cryptography and encryption policies, and human-resources security and access control.

Article 21, as substituted by Paragraph 25 of the same amending Act, puts approval and oversight of these Article 22 measures on the entity's own management body (or, for an administrative body, its governing organ), and separately requires every management-body member of an essential or important entity to complete cybersecurity training every two years sufficient to identify risks and assess risk-management practices, and to organise the same training for the entity's staff.

Both articles transpose NIS2 Articles 20 and 21 respectively, and apply, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform, which the amended annex lists among the reached digital service providers.

Article 23 of the Cybersecurity Act, as substituted by Paragraph 27 of the amending Act, requires every essential and important entity to notify СЕРИКС of every significant incident. СЕРИКС is the sectoral Computer Security Incident Response Team the Act defines at Art. 18(1). The notification runs on a graduated clock.

An early warning is due within 24 hours of becoming aware of the incident, stating where applicable whether the incident is suspected to result from unlawful or malicious acts and whether it could have a cross-border effect. An incident notification is due within 72 hours, updating that assessment with an initial severity and impact evaluation, or within 24 hours instead of 72 where the notifying entity is a trust service provider. An interim report is due on СЕРИКС's request.

A final report is due no later than one month after the incident notification, covering the incident's scope and impact, the likely threat type or cause, the mitigation measures applied and ongoing, and any cross-border effect. Where the entity has not resolved the incident by the one-month mark, it files an interim report instead and a final report within one month of resolving it.

Where appropriate and without undue delay, the entity must also notify the recipients of its service of a significant incident likely to adversely affect them and of any measures or safeguards they can take, and of a significant cyber threat and its nature; notification to recipients may be delayed, with the competent authority's consent, where it would jeopardise the incident's investigation. СЕРИКС must acknowledge the early warning within 24 hours, except where objectively impossible, and, on request, provide operational guidance or further technical support.

This article transposes NIS2 Article 23, and applies, among the sector classes the Act's annexes name, to a provider of an online marketplace, an online search engine, or a social networking services platform.

Article 5, paragraph 3 of the Electronic Commerce Act requires commercial messages that are part of or constitute an information society service to be easily recognizable as commercial, to allow clear identification of the persons on whose behalf they are made, to state clearly the terms of any promotional offer, and to give easy access to the terms of contests and games with announced prizes.

Article 6, paragraph 1 requires a service provider that sends unsolicited commercial messages by electronic mail without the recipient's prior consent to make the message clearly and unambiguously recognizable as unsolicited as soon as it reaches the recipient.

Article 6, paragraph 3 prohibits sending unsolicited commercial messages to the electronic addresses entered in the register that the Consumer Protection Commission keeps under paragraph 2 for legal persons that do not want to receive them. Article 6, paragraph 4 prohibits sending unsolicited commercial messages to consumers without their prior consent. Article 20, paragraph 1 gives the Consumer Protection Commission overall control over compliance with the Act.

Article 23, paragraph 1 punishes a service provider that commits or permits a breach of Article 5, paragraph 3 with a fine, if the act is not a crime. Article 24, paragraph 1 punishes a service provider that commits or permits a breach of Article 6, paragraph 1, 3 or 4 with a fine, if the act is not a crime.

Article 261, paragraph 1 of the Electronic Communications Act allows calls, messages or electronic mail, with or without human intervention, for direct marketing and advertising only with the user's prior consent. The consent may be withdrawn at any time.

Article 261, paragraph 2 lets any person who obtained a user's electronic contact details in a commercial transaction for products or services use them to send marketing about its own similar products or services, if every user can object free of charge and in a simple way, both when the transaction is concluded and to later messages. Article 261, paragraph 4 requires that person to honor every refusal to receive marketing messages.

Article 261, paragraph 5 prohibits marketing and advertising messages even where paragraphs 1 and 2 are met, if the sender cannot be identified, if the message gives no valid address for sending a refusal, or if the message fails the requirements of Article 5, paragraph 3, points 1 to 4 of the Electronic Commerce Act or encourages recipients to visit websites that fail them. Article 340 sets a fine for a breach of Article 261, paragraph 4.

Article 4а of the Electronic Commerce Act lets a provider of information society services store information in the recipient's terminal device, or gain access to information stored there, on condition that the recipient has been given the clear and comprehensive information required by Article 13 of Regulation (EU) 2016/679 and has been given the opportunity to refuse the storage or access.

Article 4а, paragraph 2 requires providers to give the recipient at any time the possibility to obtain information about the data stored in the terminal device. Under Article 4а, paragraph 3, the requirements of paragraph 1 are not mandatory for later storage or access by the same provider if the recipient has not objected.

Article 4а, paragraph 4 lifts the requirements of paragraph 1 for storage and access that are necessary for transmitting communications over an electronic communications network or for providing an information society service the recipient expressly requested. Article 24, paragraph 1 punishes a service provider that commits or permits a breach of Article 4а with a fine, if the act is not a crime. Article 20, paragraph 1 gives the Consumer Protection Commission overall control over compliance with the Act.

Article 171, paragraph 1, point 3 of the Criminal Code punishes whoever unlawfully learns a message sent by electronic means that is not addressed to them, or diverts such a message from its addressee, with imprisonment of up to one year or a fine.

Article 171, paragraph 3 punishes whoever, using special technical means, unlawfully gains access to or learns a message not addressed to them that was sent by telephone, telegraph, a computer network or another telecommunications means, with imprisonment of up to two years. Article 171, paragraph 4 applies the same penalty where the object of the act is computer data sent within or between information systems, including electromagnetic emissions from an information system.

Article 171, paragraph 5 raises the penalty for an act under paragraphs 3 and 4 committed for gain, or causing significant damage, to imprisonment of up to three years and a fine.

Article 246, paragraph 1 of the Electronic Communications Act prohibits anyone other than the sender and the recipient from listening to, recording, storing or otherwise intercepting or tracking messages and their traffic data without the express consent of both sender and recipient, except where a law provides otherwise.

Article 246, paragraph 2 lifts that prohibition for providers of electronic communications networks or services where storage is needed for technical reasons or is an essential part of providing the service, or where authorized persons check the technical parameters of the service.

Article 247, paragraph 1 allows recording of messages and their traffic data outside those exceptions where the recording is necessary and provided for by law to prove the conclusion of commercial transactions and the sender and recipient have been told in advance of the recording, its purposes and retention period and of their right to refuse it. Article 247, paragraph 2 limits retention of the recordings to the period in which they can be used under paragraph 1, point 1.

Article 22б(1) of the Copyright and Related Rights Act has the provider of an online content-sharing service, not the user, perform the offering of electronic access to works its users upload, and the provider must obtain authorization from the rights holders for it.

Article 22б(5) makes the provider liable for offering access without the needed authorization unless it proves that it made all possible efforts to obtain authorization, made all possible efforts to a high industry standard of professional diligence to keep unavailable the works for which rights holders gave it relevant and necessary information, and acted without delay on a sufficiently substantiated notice to stop access or remove the works and made all possible efforts to prevent their future upload.

Article 22б(7) lets a genuinely new provider show only that it made all possible efforts to obtain authorization and acted without delay on a sufficiently substantiated notice. Under Article 22б(8), a provider in that position whose average monthly visitors exceed 5,000,000, calculated on the previous calendar year, must also show that it made all possible efforts to prevent the future upload of works for which it received notices.

Article 22б(9) requires the provider to give rights holders, on request, adequate information on how its practices work and, where authorization was granted, information on the use of the authorized works. Article 22б(10) keeps lawful uploads available and requires the provider to state in its terms and conditions the possibilities for permitted free use of works.

Article 22б(11) requires the provider to put in its terms and conditions, and to apply, quick and effective procedures for users' complaints and dispute resolution about access being stopped or works removed, with an address for complaints and a time limit, and a refusal of a complaint must be reasoned. Article 22б(13) has complaints decided without undue delay and subjects decisions to stop access to or remove uploaded content to human review.

Article 22б(16) excludes non-profit online encyclopedias, non-profit educational and scientific repositories, open-source software platforms, electronic communications providers, online marketplaces and business-to-business and personal-use cloud services from the definition of an online content-sharing service provider. Article 22б(4) disapplies Article 16(1) of the Electronic Commerce Act, the hosting exclusion, to the acts the Article covers.

Chapter four of the Electronic Commerce Act, with Article 16, was repealed by Paragraph 21 of the Act of 21 November 2025 amending the Electronic Communications Act.

Article 1(3) of the Electronic Communications Act, added by Paragraph 1 of the amending Act, makes the Act govern the supervision of providers of intermediary services for compliance with Regulation (EU) 2022/2065 and the interaction between the competent authorities in carrying it out. Article 21(6) makes the Communications Regulation Commission the digital services coordinator under Article 49(2) of the Regulation.

Article 49г(1) names the Communications Regulation Commission and the Council for Electronic Media as the competent authorities under Article 49(1) of the Regulation. Under Article 49г(3), the Council for Electronic Media supervises providers of video-sharing platforms for their duties under the Regulation, except the duties in Articles 25 and 27, which the Commission supervises for every provider of intermediary services.

Under Article 49г(4), the Commission for Personal Data Protection supervises the processing of personal data under the Regulation. Article 49д requires a court or administrative authority that issues an order under Article 9 or 10 of the Regulation to send the Commission a copy of it. Article 310а has the Commission certify out-of-court dispute settlement bodies for disputes between recipients of the service and providers of online platforms.

Article 310в has the Commission grant trusted flagger status under Article 22 of the Regulation. Article 310д has the Commission grant approved researcher status, for a specific study, to a person or legal entity established in Bulgaria that seeks access to data of a very large online platform or very large online search engine.

Under Article 323з, the inspecting officials may enter the premises of persons covered by Article 51(1) of the Regulation, examine documents and records in any medium, take copies, and reach information carriers including servers. Under Article 323и, the Commission may by reasoned decision require a provider of intermediary services to supply information within a deadline the officials set, and the information must be complete, accurate, reliable and not misleading.

Article 323ф(1) fines a provider of intermediary services that breaches a duty set in the Regulation up to 6 percent of its annual income, or imposes a property sanction of up to 6 percent of its worldwide annual turnover in the preceding financial year.

Article 323ф(2) sets the limit at 1 percent for failing to supply information, supplying inaccurate, incomplete or misleading information, or refusing an on-site inspection, and Article 323ф(4) allows a periodic fine of up to 5 percent of average daily worldwide turnover for each day of failing to meet the deadline the decision sets.

Paragraph 21 of the amending Act repeals chapter four of the Electronic Commerce Act, which held the provisions on the liability of information society service providers in Articles 13 to 18. Paragraph 22 adds point 25 to Article 32(1) of the Radio and Television Act, which makes the Council for Electronic Media the competent authority under Article 49 of the Regulation for services of video-sharing platforms within the meaning of that Act.

Article 130(1) applies the section to the liability of producers, distributors and traders for damage caused by a defect in a good they produced or supplied. Article 130(2) defines a good as any movable thing, whether or not it is part of another movable or immovable thing. Article 130(2) also treats electricity as a good.

Article 130(3) treats as a producer whoever, in the course of business, makes finished goods, raw materials or components, or presents itself as the producer by putting its name, trade mark or another distinguishing mark on the good. Article 130(3) also treats as a producer whoever, in the course of business, imports goods into the territory of the European Union for sale, hire, leasing or another form of distribution.

Article 130(4) defines a distributor or trader as any person other than a producer who puts a good into circulation. Article 131(1)(1) makes damage caused by death or personal injury compensable under the section. Article 131(1)(2) makes compensable the damage or destruction of a thing other than the defective good only where the thing is worth not less than EUR 500, is intended mainly for personal use and was used by the injured person for that purpose.

Article 131(1)(2) carries an amendment from State Gazette issue 70 of 2024 that took effect on 1 January 2026. Article 131(2) lets the injured person claim damages for non-pecuniary harm caused by a defective good under the general rules. Article 132(1) makes a good defective when it does not meet the generally accepted expectations for its normal use, taking account of all circumstances, including its presentation and the time it was put into circulation.

Article 132(2) provides that a good is not defective only because a better good was later put into circulation. Article 133(1) makes the producer liable for the damage whether or not it is at fault. Article 133(2) keeps the producer liable even where the good was made in line with existing standards and good practice. Article 133(2) also keeps the producer liable where an administrative authority's permission led to the good being put into circulation.

Article 134(1) makes any distributor or trader of the good liable where the producer, or the person who brought the good into the European Union, cannot be identified. Article 134(2) lifts that liability where the distributor or trader gives the name and address of the producer, importer or supplier within 14 days. Article 134(3) bars the distributor or trader from referring the injured person to a person outside Bulgaria.

Article 135(1) makes persons who answer for the same damage jointly liable. Article 135(2) makes the producer of a component and the person who fitted it jointly liable for damage caused by a defect in a good included in another good. Article 136 puts on the injured person the burden of proving the damage, the defect and the causal link between them. Article 137(1) frees the producer from liability if it proves that it did not put the good into circulation.

Article 137(1) also frees the producer if it proves that the defect probably did not exist when it put the good into circulation or appeared later. Article 137(1) also frees the producer if it proves that it did not make the good for sale or another form of distribution with a commercial purpose and did not make or distribute it in its professional activity.

Article 137(1) also frees the producer if it proves that the defect is due to the good's conformity with mandatory requirements set by public authorities. Article 137(1) also frees the producer if it proves that the state of scientific and technical knowledge when the good was put into circulation did not allow the defect to be found.

Article 137(2) frees the producer of a component if it proves that the defect is due to the design of the good the component is built into or to instructions the producer of that good gave. Article 138(1) allows the producer to be freed from liability, or its liability reduced, where the injured person's own acts contributed to the damage. Article 138(2) provides that the producer's liability cannot be reduced where an act or omission of a third party contributed to the damage.

Article 139 makes void any contract clause that releases or limits the producer's liability to the injured person for damage under the section. Article 140(1) sets a limitation period of three years from the day the claimant learned, or should have learned, of the damage, the defect and the identity of the producer. Article 140(2) applies the Law on Obligations and Contracts to the suspension and interruption of that period.

Article 141 extinguishes the injured person's rights under the section ten years after the producer put the damaging good into circulation, unless the injured person has sued the producer by then. Article 142 leaves the injured person's right to compensation under other laws untouched.

Article 67(1) lets organisations of and for people with disabilities bring an action to stop or ban acts or commercial practices that breach the Act, under the collective-protection chapter of the Civil Procedure Code. Article 67(2) lets the Agency for Persons with Disabilities bring the same action.

Article 68 lets the court order the manufacturer, importer, distributor or service provider to publish the judgment at its own expense, to make a public corrective statement and to stop the practice by a set date. Article 69(1) lets organisations of and for people with disabilities sue for damages caused to the collective interests of people with disabilities.

Article 70 lets such an organisation sue for damages on behalf of two or more identifiable consumers who suffered individual damage from the same manufacturer, importer, distributor or service provider, on the written authority of at least two of them. Article 72 excludes procedures for awarding public contracts under the Public Procurement Act from the collective-protection section.

Article 54(1) points 1 and 2 give the Communications Regulation Commission control of electronic communications services and the Council for Electronic Media control of services giving access to audiovisual media services.

Article 54(1) points 3 to 6 give the Civil Aviation Administration, the Automobile Administration Executive Agency, the Railway Administration Executive Agency and the Maritime Administration Executive Agency control of air, bus, rail and waterborne passenger transport services.

Article 54(1) points 7 and 8 give the Financial Supervision Commission and the Bulgarian National Bank control of consumer banking services, by the kind of service listed in point 25 of paragraph 1(1) of the additional provisions. Article 54(1) point 9 gives the Ministry of Culture control of e-books and dedicated software.

Article 54(1) point 10 gives the Commission for Consumer Protection control of the consumer banking services of point 25(a) of paragraph 1(1) of the additional provisions and of e-commerce services. Article 55(1) lets the authorised officials carry out inspections, enter freely the premises and other sites used to provide services, and require the Annex 5 information, the Article 3 assessment and original books and documents.

Article 57 lets the authorities, in line with proportionality, order a service brought into conformity, by an act that can be appealed under the Administrative Procedure Code. Article 58(3) requires the authorities, on finding that a service does not meet the Act, to require the provider without delay to take corrective action within a set period. Article 86 fines a service provider that breaches its Article 3 duties from BGN 500 to 3,000, or imposes a property sanction of BGN 1,000 to 5,000.

Article 87 fines a service provider that fails to provide information on request, or provides false, incomplete or late information or none in Bulgarian, from BGN 1,000 to 10,000, or imposes a property sanction of BGN 2,000 to 15,000. Article 88 fines whoever obstructs the control under Article 55(1) from BGN 2,000 to 10,000, or imposes a property sanction of BGN 5,000 to 15,000.

Article 89 fines a breach of a Chapter Three duty that no other article punishes from BGN 1,500 to 10,000, or imposes a property sanction of BGN 3,000 to 20,000, and for a repeat breach a fine of BGN 3,000 to 20,000 or a property sanction of BGN 6,000 to 40,000. Article 91 has the authority named in Article 54(1) issue the penal decrees, and lets it end the proceedings with a reasoned resolution, issue a warning or conclude an agreement.

Article 18 allows an importer to place on the market only products that comply with the Act. Article 19 requires an importer, before placing a product on the market, to ensure that the manufacturer drew up the technical documentation and carried out the conformity assessment, that the CE marking is affixed and that the product carries the required documents. Article 20 requires an importer to put its name, registered trade name or trade mark and postal address on the product.

Article 21 bars an importer from placing on the market a product it considers or has reason to consider non-conforming until it is brought into conformity. Article 23 requires an importer to keep a copy of the EU declaration of conformity for five years after the product is placed on the market. Article 26 requires a distributor to act with due care in relation to the requirements of the Act.

Article 27 requires a distributor, before making a product available, to check the CE marking, the documents, the Bulgarian instructions and safety information, and that the manufacturer and importer have met their marking duties. Article 28 bars a distributor from making available a product it considers or has reason to consider non-conforming until it is brought into conformity.

Article 32 treats an importer or distributor that places a product on the market under its own name or trade mark, or modifies a product already on the market so that conformity may be affected, as the manufacturer. Article 33 requires every economic operator to keep, for five years after the date of delivery, information on the operators that supplied it with a product and those it supplied.

Article 11(1) requires a manufacturer placing a product on the market to ensure that it is designed and produced in line with the applicable accessibility requirements of Article 4. Article 11(2) and (3) require the manufacturer to draw up the technical documentation, carry out the conformity assessment of Annex 3, draw up the EU declaration of conformity and affix the CE marking.

Article 11(4) requires the manufacturer to keep the technical documentation and the EU declaration of conformity for five years after the product is placed on the market. Article 8(2) requires the EU declaration of conformity to state which accessibility requirements are the subject of an exception under Article 3.

Article 8(4) requires the EU declaration of conformity to be translated into Bulgarian when the product is placed or made available on the Bulgarian market and was not drawn up in Bulgarian. Article 12 requires the manufacturer to apply procedures that keep series production in conformity. Article 13 requires the manufacturer to mark the product with an identifying element and with its name, registered trade name or mark and postal address.

Article 14 requires the manufacturer to supply the product with instructions and safety information in Bulgarian. Article 15 requires the manufacturer to take corrective action at once on a product it considers or has reason to consider non-conforming and to inform the market surveillance authorities. Article 17 lets the manufacturer appoint an authorised representative in writing but bars delegating the duties of Article 11(1) and the drawing up of the technical documentation.

Article 3(1) applies the accessibility requirements only so far as compliance does not require a significant change that fundamentally alters the nature of a product or service and does not impose a disproportionate burden on the economic operators. Article 3(2) requires an economic operator that relies on the exception to assess whether compliance would cause a fundamental alteration or a disproportionate burden, using the criteria of Annex 1 and of the Commission's delegated acts.

Article 3(3) requires the operator to document the assessment, keep the results for five years and give a copy to the authorities on request. Article 3(4) exempts microenterprises that deal with products from documenting the assessment but requires them to give the market surveillance authority the facts of the assessment on request.

Article 3(5) requires a service provider to renew its disproportionate-burden assessment for each category or type of service when the service changes, on request of the authority and at least every five years. Article 3(6) requires an operator other than a microenterprise that relies on the exception to send information about it to the authorities of the Member State where the product is placed on the market or the service is provided.

Article 3(7) denies the disproportionate-burden exception to an operator that receives funding from sources other than its own resources for improving accessibility.

Article 34(1) makes the Chair of the State Agency for Metrological and Technical Supervision, through the agency's market surveillance bodies, the market surveillance authority for the products in Article 2(1). Article 35(1) lets the market surveillance authorities enter places where products are sold, stored or used, require the EU declaration of conformity, the technical documentation, the instructions and the Article 3 assessment, and take samples free of charge.

Article 35(2) lets the authority set a period of not more than 30 days, agreed with the operator, for providing the declaration and the technical documentation. Article 38(1) puts the cost of testing on the economic operator when the products do not meet the accessibility requirements.

Article 38(3) puts the cost of testing on the economic operator whatever the result when the product has no CE marking, no EU declaration of conformity or no technical documentation, or when the documentation is incomplete. Article 39 lets the authorities, where the operator has not taken corrective action, order a temporary suspension of the product's availability or use, a ban on its availability or use, or its withdrawal.

Article 39(2) and (3) have the Chair of the agency or officials he authorises impose the measures by order, which can be appealed under the Administrative Procedure Code. Article 40(3) requires the authorities, on finding that a product does not meet the Act, to require the operator to take corrective action within a set period and to impose a temporary suspension until the non-conformity is removed.

Article 73(1) fines a manufacturer or importer that places on the market or puts into service a product that does not meet Article 4 from BGN 1,000 to 5,000, or imposes a property sanction of BGN 5,000 to 25,000, and for a repeat breach a fine of BGN 2,000 to 10,000 or a property sanction of BGN 10,000 to 50,000.

Article 74(2) fines a manufacturer or importer whose technical documentation or EU declaration does not meet the Act from BGN 1,000 to 5,000, or imposes a property sanction of BGN 5,000 to 20,000, and for a repeat breach a fine of BGN 2,000 to 10,000 or a property sanction of BGN 10,000 to 50,000. Article 75(1) fines an economic operator that makes a product available without the CE marking from BGN 150 to 1,000, or imposes a property sanction of BGN 500 to 4,000.

Article 84 fines an economic operator that makes products available and fails its Article 3 duties from BGN 500 to 3,000, or imposes a property sanction of BGN 1,000 to 5,000. Article 82 fines whoever obstructs the market surveillance authorities or fails to provide the Article 35 documents from BGN 1,000 to 5,000, or imposes a property sanction of BGN 5,000 to 20,000.

Article 90 has the officials designated by the Chair of the agency draw up the records of violations and the Chair or his authorised officials issue the penal decrees, and sends the sums collected to the agency's budget account.

Article 2(1) applies the Act to consumer general purpose computer hardware systems and their operating systems, to payment terminals, to ATMs, ticketing machines, check-in machines and interactive self-service information terminals, to consumer terminal equipment with interactive computing capability used for electronic communications services or for access to audiovisual media services, and to e-readers.

Article 2(1) point 2(e) excludes from the interactive information terminals those installed as an integral part of vehicles, aircraft, ships or rolling stock. Article 4(1) allows products other than self-service terminals to be made available on the market only if they meet the accessibility requirements of sections I and II of Annex 2, taking into account the functional performance criteria of section VI.

Article 4(2) allows self-service terminals to be made available on the market only if they meet the accessibility requirements of section I of Annex 2, taking into account the functional performance criteria of section VI. Article 5 bars prohibiting, restricting or impeding, for accessibility reasons, the making available of products that comply with the Act.

Article 6(1) presumes that a product conforming to harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union meets the accessibility requirements those standards cover. Article 6(2) gives the same presumption to a product that conforms to technical specifications adopted under Article 15(3) of Directive (EU) 2019/882.

Article 60 gives products and services outside Article 2 a presumption of fulfilling the accessibility obligations in other European Union acts where their features meet section V of Annex 2. Article 61(1) gives the presumption of Article 60 to products and services outside Article 2 that conform to harmonised standards published in the Official Journal of the European Union, so far as those standards meet the accessibility requirements of the Act.

Article 2(2) applies the Act to electronic communications services other than machine-to-machine transmission services, to services providing access to audiovisual media services, to the websites, mobile services, electronic tickets, travel information and interactive terminals of air, bus, rail and waterborne passenger transport, to consumer banking services, to e-books and dedicated software, and to e-commerce services.

Article 2(3) excludes from the Act pre-recorded time-based media and office file formats published before 28 June 2025, certain online maps, third-party content the operator did not fund, develop or control, and archive content. Article 46(1) allows services other than urban, suburban and regional transport services to be provided only if they meet the accessibility requirements of sections III and IV of Annex 2, taking into account the functional performance criteria of section VI.

Article 46(2) allows urban, suburban and regional transport services to be provided only if they meet the requirements of section IV of Annex 2, taking into account the functional performance criteria of section VI. Article 46(3) exempts microenterprises that offer services from the accessibility requirements and from all obligations connected with complying with them.

Article 47 bars prohibiting, restricting or impeding, for accessibility reasons, the provision of services that comply with the Act. Article 48(1) presumes that a service conforming to harmonised standards, or parts of them, whose references are published in the Official Journal of the European Union meets the accessibility requirements those standards cover.

Article 48(2) gives the same presumption to a service that conforms to technical specifications adopted under Article 15(3) of Directive (EU) 2019/882. Article 49(1) treats a service as meeting the accessibility requirements of Article 46 where it meets the accessible-information requirements of one of the listed air, rail, maritime, bus or rail-interoperability passenger rules. Article 49(2) applies in full any additional requirement the Act sets beyond those acts.

Article 50 requires a service provider to design and provide services in line with Article 46, to prepare the information required by Annex 5 explaining how the services meet the requirements and to keep it for as long as the service is provided. Article 51 requires a service provider to apply procedures that keep services in conformity throughout their provision.

Article 52 requires a service provider to take the corrective measures needed and to inform the competent authority and the authorities of the other Member States where the service is provided at once when a service does not meet the requirements. Article 53 requires a service provider to give the competent authority, on a reasoned request and in Bulgarian within the time set, the information needed to show conformity, and to cooperate on corrective action.

Paragraph 4(1) of the final provisions lets service providers continue until 28 June 2030 to use products that they lawfully used for similar services before that date. Paragraph 4(2) of the final provisions lets service contracts concluded before 28 June 2025 continue unchanged until they expire, but not later than five years after that date.

Paragraph 4(3) of the final provisions lets self-service terminals that service providers lawfully used before 28 June 2025 stay in use until the end of their economically useful life, but not longer than 20 years after entering use.

Paragraph 4(4) of the final provisions lets the emergency-call obligations of section IV of Annex 2 also be met until 28 June 2027 through a relay service provider, including applications built into the operating system of terminal devices or other applications of the economic operator or of a third party.

Article 8a(1) requires media service providers to ensure that the content of their services gradually becomes accessible to people with impaired vision or hearing, by means that include sign language interpretation, subtitles for deaf and hard-of-hearing people, spoken subtitles and audio description.

Article 8a(1) requires radio service providers to offer, over the internet, mobile applications or other technical means, programmes accessible to people with impaired vision or hearing in the periods and ways set in their action plans. Article 8a(2) requires media service providers to give the Council for Electronic Media three-year action plans for continuously and gradually increasing the accessibility of their services and annual progress reports.

Article 8a(3) requires media service providers to make emergency information, including public announcements and natural-disaster messages broadcast through audiovisual media services, available in a way accessible to people with disabilities. Article 8a(4) requires public media service providers to make news and current-affairs television programmes accessible to people with impaired vision or hearing in line with technological development and their economic means.

Article 8a(4) leaves the specific accessibility duties of the Bulgarian National Radio and the Bulgarian National Television to their licences. Article 8a(4) binds only the public media service providers. Article 8a(6) has the Council for Electronic Media keep on its website the contact details of an official designated to give information and receive complaints on accessibility.

Article 126(1), which sets the property sanction for a media service provider's breach of the provisions it lists, does not list Article 8a. Article 127 has the officials of the Council for Electronic Media establish violations of the Act and its Chair issue the penal decrees.

Article 8a(5) requires media service providers with national coverage and terrestrial digital television broadcasting of polythematic or informational programmes and an average daily audience share above 20 percent, and the television programmes of the Bulgarian National Television, to provide Bulgarian sign language interpretation in at least one news issue between 19:00 and 23:30.

Article 127 has the officials of the Council for Electronic Media establish violations of the Act and its Chair issue the penal decrees.

Article 48(5) requires the technical specifications to be consistent with the accessibility criteria for people with disabilities, or to allow people with disabilities to use the result, when natural persons will use the result of the contract. Article 48(6) requires the technical specifications to refer to the mandatory accessibility requirements that an act of the European Union sets.

Article 59 of the Accessibility Requirements for Products and Services Act makes the accessibility requirements of its Annex 2 for the products and services of Article 2 the mandatory accessibility requirements within the meaning of Article 48(6) of the Public Procurement Act. Article 70(4) point 1 lets the quality indicators of the best price-quality award criterion include accessibility and design for all users.

A media service provider must not create or distribute programs that could harm a child's physical, psychological, moral or social development, per Article 17a(1). The Council for Electronic Media adopts a Code of Conduct with providers, including the public broadcasters BNT and BNR, prescribing measures such as scheduling, age-verification tools and encoding to assess, label and restrict access to harmful programs, per Article 17a(3) and (4).

Since the 2020 transposition of the amended AVMSD, a video-sharing platform provider must take appropriate measures, including age-verification systems, to protect children from user-generated videos and audio-visual commercial communications that could harm their development, alongside signalling, parental-control, and media-literacy measures, per Article 19d. A media service provider that violates Article 17a(1) is subject to a property sanction of BGN 15,000 to 30,000, doubled on a repeat violation.

A video-sharing platform provider that violates the Act is subject to a property sanction of BGN 2,000 to 5,000 under Article 126d, with the sanction doubled for a repeat offence.

A press publication publisher holds the exclusive right to license, for payment, an information-society service provider's online reproduction of its press publications or parts of them, and the offer of electronic access to them, per Article 90d(1). The right does not apply to an individual's personal or non-commercial use, reproduction of the facts reported, the use of single words or very short extracts, or the creation of hyperlinks, per Article 90d(2). The right lasts two years from first publication, running from the following 1 January, per Article 90zh.

A person with lawful access to a work, including a press publication, may reproduce it or extract data from it for automated text-and-data analysis without the rightsholder's consent, per Article 26e(1).

A rightsholder, including a press publisher, may reserve that use by technical means that the software performing the analysis can recognize, and for works available electronically the prohibition has effect only if so established, per Article 26e(4); a news aggregator indexing press content must honor that reservation to remain within the exception.

A separate exception in Article 26zh, not subject to that reservation, covers universities, libraries and research institutes mining for scientific research, and Article 26k(2) obliges a rightsholder to give such a research user access within 72 hours of a request.