Bulgaria. Comprehensive data protection. Act
PDPA / ZZLDPersonal Data Protection Act (Закон за защита на личните данни)
Partly verified
Medium confidence.text_url points to CPDP site; official gazette (dv.parliament.bg) deep link not verified.
§1Summary
- Synopsis
Bulgaria's PDPA, extensively amended in 2019, supplements the GDPR and transposes the Law Enforcement Directive. It sets national rules on employee data, national ID number publication, and balancing data protection with freedom of expression.
- Key themes
- Unique features
Age of digital consent (GDPR Art 8): 14. Lists criteria to balance freedom of expression against privacy (partly annulled by the Constitutional Court in 2019); restrictions on copying ID documents and publishing personal identification numbers; employers must adopt internal rules for monitoring and whistleblowing data.
- SaaS relevance
Applies alongside the GDPR to any SaaS provider established in, or targeting users in, this country; national rules on age of consent, employee data and offences shape onboarding and HR-related features.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Authority 72h; individuals without undue delay (GDPR Arts 33-34)
- DPO
- Conditional
- Cross-border transfers
- GDPR Chapter V (adequacy/SCCs/BCRs)
- Maximum penalty
- GDPR Art 83: €20m or 4% global turnover
§3Dates
- Key dates
- Adopted
- In force
- Amended for GDPR by SG No. 17/2019, in force 2019-03-02
§4Text and authority
- Text
- Authoritative text cpdp.bg
- Authority
- Commission for Personal Data Protection (CPDP)
§5Where it applies
- Domestic law of
- Bulgaria
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.text_url points to CPDP site; official gazette (dv.parliament.bg) deep link not verified.