Data protection in Bulgaria

The GDPR applies directly, with Bulgarian legislation supplementing the European framework.

The General Data Protection Regulation (GDPR) is the main framework for processing personal data in Bulgaria. The Bulgarian Personal Data Protection Act (PDPA) adds national rules and addresses particular situations. Employment, healthcare, accounting and other sector legislation may also apply. The requirements depend on the actual processing, not simply the size of the business.

A useful starting point is a process map: whose data you use, why, on what basis, who can access it and when it is deleted. Separate legal obligations from internal business preferences. A privacy notice alone does not demonstrate that these decisions are implemented.

Example: an online retailer uses a delivery address, invoice details and purchase history. These activities may have different legal bases and retention periods. One generic period of “as long as necessary” does not help the team decide when each record should be removed.

Legal basis: Regulation (EU) 2016/679, Articles 2–6, 24–25 and 30; Bulgarian Personal Data Protection Act, Article 1.

An organisation’s role follows the decisions it actually makes about processing.

Personal data relates to an identified or identifiable individual. It may include a named business email address, customer number, call recording or location. Replacing a name with a code does not automatically make data anonymous. If additional information can identify the person, data protection remains relevant.

Health information, political opinions and other Article 9 categories need an additional processing condition alongside a legal basis. Biometric data falls within this special regime when processed to identify someone uniquely. Criminal convictions and offences are subject to separate rules.

A controller determines the purposes and means; a processor acts on its behalf. Example: an employer decides why salaries are calculated, while an external supplier may handle payroll under its instructions. The contract’s label does not settle the role. Joint decisions about purposes may instead create joint controllership, requiring an appropriate allocation of responsibilities.

Legal basis: GDPR, Articles 4, 9–10, 26 and 28; Recital 26.

There is no general controller registration; specific accountability and notification duties remain.

The Commission for Personal Data Protection (CPDP) is the national supervisory authority for ordinary business processing under the GDPR. It handles complaints, investigates and exercises corrective powers. Judicial activities and certain specialist regimes have particular arrangements. Cross-border processing may require an assessment of competence and the relevant lead supervisory authority.

The general requirement to register controllers with the CPDP ended on 25 May 2018. This did not remove duties concerning processing records, security, individual rights or demonstrating compliance. Notification of an appointed DPO and notification of a personal data breach are separate obligations.

Example: a new accounting business does not need a certificate of general GDPR registration. It needs to clarify its roles, arrange client contracts and document processing. An inspection concerns actual practices and supporting evidence, including who made decisions and how the organisation put them into effect.

Legal basis: GDPR, Articles 5(2), 30–31 and 51–58; Bulgarian PDPA; CPDP clarification on the end of controller registration.

An external DPO can work under a service contract with independence, expertise and access.

A DPO is mandatory for public authorities, subject to the exception for courts, and where core activities involve large-scale regular and systematic monitoring or large-scale processing of special-category or criminal-conviction data. Headcount alone is not a universal test.

The role may be performed externally under a service contract. The DPO advises, monitors compliance and acts as a contact point; management remains responsible for its decisions. The organisation must provide timely involvement, resources, direct reporting to senior management and freedom from conflicts of interest. Contact details must be published and communicated to the CPDP.

Example: an external DPO reviews a proposed HR platform before the contract is signed and provides advice. Management decides whether to introduce it and with which safeguards. Training helps develop the necessary expertise, but the GDPR does not establish a general requirement for a particular DPO certificate.

Legal basis: GDPR, Articles 37–39, particularly Article 37(6)–(7); CPDP procedure for notifying an appointed DPO.

Consent is one legal basis, not a universal substitute for assessing the processing.

Each purpose needs an applicable Article 6 basis, such as contractual necessity, a legal obligation, legitimate interests or consent. A legitimate-interests assessment examines the purpose, necessity and balance with individuals’ rights. Consent must be freely given, specific, informed and unambiguous, with an easy way to withdraw it.

Privacy information should describe the actual process: controller, purposes, bases, recipients, transfers, retention and rights. For direct collection, it is provided when the information is collected. Indirect collection follows the timing rules and exceptions in Article 14.

Example: asking for a quotation does not automatically mean agreeing to a newsletter. Separate answering the enquiry from future advertising and check the rules for the chosen channel. One “I agree to everything” checkbox does not resolve different purposes and may give customers a misleading impression about the choices available to them.

Legal basis: GDPR, Articles 5–7 and 12–14; additional Article 9 conditions for special-category data.

Provide a clear route for requests and track the deadline from receipt.

Individuals may have rights of access, rectification, erasure, restriction, portability and objection. Their application depends on the legal basis and circumstances: erasure does not override a legal retention duty, for example. A request is not invalid simply because it reaches a general email address rather than a dedicated form.

Respond without undue delay and normally within one month. Where necessary because of complexity and the number of requests, the period may be extended by two further months, explaining the extension and reasons during the first month. If there are reasonable doubts about identity, request only the additional information needed to confirm it.

Example: a former employee requests a copy of their data. The team checks HR systems, relevant archives and applicable limitations without automatically disclosing colleagues’ information. The DPO may help coordinate the assessment, while the organisation records its search and response.

Legal basis: GDPR, Articles 12 and 15–22; Article 19 on notifying recipients.

Check both the contract and actual access, including support teams and subprocessors.

When a supplier processes personal data on your behalf, the arrangement must meet Article 28. The agreement addresses instructions, confidentiality, security, subprocessors, assistance with rights and incidents, audits, and return or deletion. A general commercial promise of “GDPR compliance” does not replace these terms.

Making data available to another organisation outside the European Economic Area also requires a Chapter V assessment. Check an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, together with the necessary assessment and supplementary measures. Derogations are not a convenient general mechanism for routine transfers.

Example: files are hosted in the EU, but an external support team accesses them from a third country. Server location alone does not settle the transfer question. For an AI service, also check whether the provider uses submitted information to train models for its own purposes.

Legal basis: GDPR, Articles 28–29, 32 and 44–49; Commission Implementing Decision (EU) 2021/914 on standard contractual clauses.

The supervisory notification clock starts on awareness; notification depends on risk.

Security measures follow the risks to people and cover confidentiality, integrity and availability. Access management, backups, updates and training work together. Loss of access to data can be a breach even without evidence that information reached an outside recipient.

The controller notifies the competent supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk individuals’ rights and freedoms. Likely high risk also requires communication to affected individuals without undue delay, unless an applicable exception applies. All breaches are documented. A processor informs the controller without undue delay.

Example: payroll is emailed to the wrong address. Establish the recipient, contents and options to contain access, and record the risk assessment. Do not wait for a final technical report if the notification clock is running: information can be supplied in phases.

Legal basis: GDPR, Articles 4(12) and 32–34; CPDP Article 33 breach notification form.

Assess the impact before processing where high risk to people is likely.

A data protection impact assessment (DPIA) examines the intended processing, its necessity and proportionality, risks and safeguards. It is mandatory where high risk is likely, including certain large-scale operations, systematic monitoring and significant automated evaluations. The CPDP list and relevant guidance also need to be considered.

The assessment is more than a supplier questionnaire. It needs input from legal, technical and operational teams and advice from the DPO where appointed. If high risk remains despite the planned measures, prior consultation with the supervisory authority is required. A change in risk may call for reassessment.

Example: an employer considers an AI system that scores candidates. Before a pilot, clarify the data, criteria, human intervention and consequences of error. Testing with synthetic data can help with technical checks, but does not replace assessment of the intended real-world use.

Legal basis: GDPR, Articles 35–36; CPDP list under Article 35(4).

Separate recruitment, employment records and monitoring: their purposes and retention differ.

Employers process information for recruitment, payroll, legal duties and managing work. These activities do not all depend on consent: the imbalance in employment can prevent consent being freely given. Access to health records and other sensitive information should be limited to the specific need.

Article 25k of the Bulgarian PDPA limits retention of recruitment participants’ data to six months unless they consent to longer storage; special legislation may provide otherwise. CPDP guidance connects the start of the period to the final conclusion of recruitment. This is not a universal deadline for all records of a hired employee.

Example: an unsuccessful candidate’s CV should not remain indefinitely in a shared folder. For future vacancies, set a separate period and obtain appropriate consent. For CCTV or access monitoring, assess necessity, scope, information to employees and less intrusive alternatives.

Legal basis: GDPR, Articles 5–6, 9, 13 and 88; Bulgarian PDPA, Articles 25i and 25k; CPDP opinion on recruitment retention.

Channel-specific advertising rules must be checked separately from the GDPR legal basis.

A list of public email addresses is not unrestricted permission to run advertising campaigns. Electronic communications and e-commerce rules apply alongside the GDPR. The channel, recipient and any existing customer relationship matter. The exception for your own similar products or services has conditions, including easy opt-out; it is not blanket permission for purchased lists.

An objection to direct marketing ends processing for that purpose. For optional tracking through advertising cookies and similar technologies, provide a valid prior choice and easy withdrawal. Assess strictly necessary technologies against the service the user expressly requested, not the marketing team’s convenience.

Example: adding an analytics or advertising pixel changes processing even if the page looks identical. Test what loads before a choice, after refusal and after withdrawal. A banner only helps when it actually controls the technologies involved.

Legal basis: GDPR, Articles 6–7 and 21; Bulgarian Electronic Communications Act, Article 261; Electronic Commerce Act, Articles 4a and 6; Directive 2002/58/EC, Articles 5(3) and 13.

AI does not displace the GDPR. Assess the data, supplier, use and effects on people.

Entering customer documents, CVs or conversations into an AI tool processes personal data when they contain information about identifiable people. Check the legal basis, purpose, minimisation, retention and transfers. A claim that a model is “anonymous” or a provider is “GDPR compliant” does not replace a specific assessment.

The AI Act adds a separate framework based on the organisation’s role and the system’s purpose and risk. Practical work includes an inventory of uses, applicable-obligations assessment, developing AI literacy and appropriate human oversight. Decisions with significant effects also require an Article 22 GDPR assessment; a person formally approving an output does not necessarily provide meaningful intervention.

Example: a team wants AI to summarise customer enquiries. Start with unnecessary personal data, training settings, access and output checks. If the use changes to scoring customers, repeat the assessment rather than relying on the previous approval.

Legal basis: GDPR, Articles 5–6, 9, 13–14, 22, 28 and 35; Regulation (EU) 2024/1689 (AI Act), applicable role- and use-specific rules including Article 4; EDPB Opinion 28/2024.