Bulgaria

The Personal Data Protection Act (Закон за защита на личните данни, promulgated in State Gazette No. 1 of 4 January 2002, comprehensively rewritten by State Gazette No. 17 of 26 February 2019) states in Article 1(1) that it governs matters 'in so far as they are not governed by Regulation (EU) 2016/679'. So the General Data Protection Regulation does the heavy lifting on territorial reach (its Article 3), and the Bulgarian Act layers national rules on top. Two Bulgarian-specific scoping points matter. Article 1(7) treats the European Economic Area states AND Switzerland as equivalent to European Union member states, so a transfer to Switzerland is not a third-country transfer under Bulgarian law at all. Article 1(6) excludes data about dead people, except for the narrow case in Article 25e. Article 1(5) excludes national defence and national security processing unless a special law says otherwise. There is no registration or licensing step for controllers, but Article 25b obliges every controller and processor to notify the regulator of its data protection officer's name, Bulgarian personal identification number and contact details, and of any later change.

Sector by sector, checked 18 August 2026. ONLINE GAMBLING — mirror The Gambling Act (Закон за хазарта) Article 6(1)(2) requires the communications equipment and the central point housing the central computer system to be located in Bulgaria or another European Union member state. Article 6(4) goes further and requires ALL data to be stored on a data storage device — a 'control local server' — located on the territory of the Republic of Bulgaria. Article 6(2) says 'territory of the Republic of Bulgaria' means only the geographic territory of the country. Article 6(1)(4) requires a system feeding session information in real time to a server of the National Revenue Agency. This is the only hard storage-in-country rule found for Bulgaria. TELECOMS — data can leave once conditions are met in law, in-country infrastructure in practice. The Electronic Communications Act (Закон за електронните съобщения) Article 251b requires providers of public electronic communications networks or services to retain six categories of connection data for six months. The Act does NOT say where that retained data must sit. However Articles 304, 305 and 307 require operators to provide, commission and maintain at their own expense interception interfaces feeding the facilities of the State Agency for Technical Operations and the State Agency for National Security, and to hand over encrypted traffic in its original form. That is a physical Bulgarian infrastructure obligation, not a data residency rule. BANKING, PAYMENTS, INSURANCE, SECURITIES — conditional No Bulgarian data-residency rule found, checked 18 August 2026. The Credit Institutions Act Article 62 imposes bank secrecy, which restricts WHO may see data, not WHERE it sits. The European Union's Digital Operational Resilience Act is the operative outsourcing regime and requires the contract to state where data is processed, but imposes no localisation. HEALTH — conditional No localisation rule found. The National Health Information System is a centralised state system run by the Ministry of Health, so state-held e-prescription and e-referral data is in Bulgaria by design, but private clinics are not told where to host their own records. GOVERNMENT — conditional The Electronic Governance Act defines a 'State hybrid private cloud' as centralised state infrastructure, and the State Agency and later the Ministry of Electronic Governance build and share it. Neither that Act nor the implementing ordinance on general requirements for information systems contains a rule that public bodies' data must stay in Bulgaria. In practice public procurement pushes systems into the state cloud. MAPPING AND GEOSPATIAL — data can leave once conditions are met with a collection permit. The Geodesy and Cartography Act Article 15(2) requires aerial photography and other remote-sensing work to be cleared in advance with the Ministry of Defence, the Ministry of the Interior, the State Agency for National Security, the Ministry of Foreign Affairs and the transport ministry. Article 20 requires state-commissioned survey material to be deposited in the state Geo-Cartographic Fund, and Article 21 keeps aerial films, digital aerial data and satellite imagery there indefinitely. EDUCATION, ECOMMERCE, SOCIAL MEDIA, DEFENCE — no separate Bulgarian localisation rule found, checked 18 August 2026. Defence and national security processing is carved out of the Personal Data Protection Act entirely and is handled under classified information law.

Model: allowlist, operated at European Union level and fully populated. The approved destinations as verified against the European Commission's own list on 18 August 2026 are Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada (commercial organisations only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. Outside that list the 2021 Standard Contractual Clauses (Decision (EU) 2021/914) are the workhorse and remain unamended; the promised new clauses for importers already directly caught by the Regulation are still not adopted as of 18 August 2026. Binding Corporate Rules remain available. The Article 49 derogations are narrow and are not a route for systematic or large-scale transfers. A transfer impact assessment is still expected. The EU-US Data Privacy Framework is in force and legally valid on 18 August 2026 but under pressure: the Latombe challenge was dismissed by the General Court on 3 September 2025 and is on appeal to the Court of Justice since 31 October 2025, and on 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether United States institutional changes affect the adequacy decision's validity. The Commission has not suspended or revoked it. Bulgaria adds nothing on top: the Personal Data Protection Act contains no separate transfer chapter for general processing and no residency clause. Its Article 1(7) does add that European Economic Area states and Switzerland rank equal to European Union member states.

The Commission for Personal Data Protection (Комисия за защита на личните данни) is constituted under Chapter Two of the Personal Data Protection Act and is the supervisory authority for the General Data Protection Regulation in Bulgaria. It is operational: it issues administrative acts, its decisions have been published through the European Data Protection Board's document library, and it took part in the Board's 2025 coordinated enforcement action. That action is also the clearest recent evidence of its posture. In the national report published by the Board in February 2026, Bulgaria reported contacting twenty-three controllers (six public sector, sixteen private sector, one military education body), receiving replies from all of them, and then answering 'no' both to whether it planned formal investigations and to whether the exercise would change its enforcement activity. It said it would run an information campaign instead. Enforcement acts are taken by decision of the Commission and penalty orders are issued by its chair, under Articles 84 to 87 of the Act; appeals go to the administrative courts within fourteen days. A second, separate supervisor exists: the Inspectorate to the Supreme Judicial Council supervises data processing by courts, prosecutors and investigators. Cybersecurity is supervised by the Minister of Electronic Governance together with sectoral competent authorities under the amended Cybersecurity Act. Gambling, including the local-server rule, is supervised by the National Revenue Agency. Important practical note: the Commission's own website was unreachable from our infrastructure on 18 August 2026, returning a server error on every attempt, so its 2025 annual report figures could not be read directly and are listed as unconfirmed.

FLOORS. The Accountancy Act (Закон за счетоводството, State Gazette No. 95 of 8 December 2015, last amended State Gazette No. 61 of 2025 in force 31 October 2025) Article 12(1) sets three periods, all counted from 1 January of the reporting period following the one they relate to: payroll sheets fifty years; accounting registers and financial statements, including documents for tax control, audit and subsequent financial inspections, ten years; all other carriers of accounting information three years. Article 12(1) says this information is kept 'in the enterprise' on paper and/or a technical medium; Article 12(2) permits storage in private or state archives under the National Archive Fund Act. Article 12(4) sends payroll sheets to the National Social Security Institute if a company is wound up with no successor. The Electronic Communications Act Article 251b(1) requires six months for six categories of connection data. The Gambling Act Article 6(4) requires gambling data to be kept in the form in which it was created for five years after the limitation period for public liabilities expires, and Article 6(5) sets a floor of at least twelve months from collection. The Geodesy and Cartography Act Article 21(3) requires carriers of field measurement data to be kept fifty years, and Article 21(2) keeps aerial films, digital aerial data and satellite imagery indefinitely in the state Geo-Cartographic Fund. CEILINGS. Personal Data Protection Act Article 25k(1): an employer must set a retention period for recruitment candidates' data that cannot exceed six months unless the candidate consents to longer, after which the documents must be erased or destroyed unless a special law says otherwise. Article 25k(2): originals or notarised copies of fitness, qualification and service-record documents must be returned to unsuccessful candidates within six months of the procedure closing. Article 25a: where data was handed over with no lawful basis or contrary to the principles of the European rulebook, the controller must return it within one month of finding out, or erase or destroy it if returning is impossible or disproportionate, and must document the erasure. The general storage-limitation principle of the European rulebook applies throughout. CONFLICT. Bulgarian drafting resolves the clash in favour of the specific statutory floor: Article 25k twice carries the phrase 'unless a special law provides otherwise'. In practice, keep the record for the statutory minimum, then delete.

Clock one: the General Data Protection Regulation, Article 33. Notify the Commission for Personal Data Protection without undue delay and where feasible within 72 hours of becoming aware; tell affected individuals without undue delay where the risk to them is high. This is the clock that catches most organisations. Clock two: the Cybersecurity Act as rewritten by the Act published in State Gazette No. 17 of 13 February 2026, which transposes the European network and information security directive known as NIS2. For a significant incident an essential or important entity must send an early warning within 24 hours of establishing the incident and an incident notification within 72 hours; qualified trust service providers must send that notification within 24 hours. The old 2018 text, which demanded an early warning within two hours and a full report within five working days, has been superseded. The Minister of Electronic Governance keeps the register of covered entities and sectoral competent authorities supervise. Clock three: for financial entities, Regulation (EU) 2022/2554 (the Digital Operational Resilience Act) has applied since 17 January 2025 and adds its own initial, intermediate and final report deadlines. It is a specialist regime that takes precedence over general national information technology rules for those firms. The overlap is the operational failure point. One incident at a bank can simultaneously be a personal data breach, a significant cybersecurity incident and a major financial information and communications technology incident, with three different recipients and three different formats.

Trap 1 — no copying identity documents. Personal Data Protection Act Article 25g: a controller or processor may copy an identity card, a driving licence or a residence document only where a law provides for it. Foreign 'take a photo of your passport' onboarding flows walk straight into this. Breach carries the higher European fine tier under Article 85(2). Trap 2 — children's age is fourteen. Article 25c requires a parent's or guardian's consent for consent-based processing of anyone under fourteen, including direct offers of information society services. Bulgaria chose the lowest age the European rulebook permits, so a global product built to sixteen is over-compliant here, and one built to thirteen is non-compliant. Trap 3 — the six-month recruitment ceiling. Article 25k(1) caps retention of unsuccessful candidates' data at six months absent consent, and Article 25k(2) forces return of original or notarised documents within six months. Applicant tracking systems set to a two-year default breach this. Trap 4 — a disapplied clause still printed in the law. Article 25z(2) sets out ten criteria for balancing free expression against privacy in journalism. The Constitutional Court declared it unconstitutional by Decision No. 8 of 2019, published in State Gazette No. 93 of 26 November 2019. The text remains in the consolidated statute with only a bracketed note, and Article 85(2) still lists 'Article 25z, paragraphs 1 and 2' among the punishable breaches. A naive text search reads this as binding. It is not. Trap 5 — a language requirement on your systems, and named-person duties. Accountancy Act Article 11(2): where accounting software is used it must be built to this Act's requirements and must allow the data it processes and its output documents to be in the Bulgarian language. Separately, Personal Data Protection Act Article 25b requires you to notify the regulator of your data protection officer's name, Bulgarian personal identification number (or the equivalent for a foreigner) and contact details, and every later change. Article 25i requires employers to adopt and publish written rules and procedures for whistleblowing systems, restrictions on internal company resources, and any access-control, working-time or discipline-monitoring systems. Article 25zh(2) bans using the Bulgarian personal identification number as the only means of identifying a user for remote access to an online service.

DATED AND CERTAIN. 12 January 2027 — the European Data Act (Regulation (EU) 2023/2854), applicable since 12 September 2025, requires all cloud switching charges and data egress fees to fall to zero. Its Chapter VII also restricts third-country government access to non-personal data held in the European Union. 13 February 2026 — Bulgaria's amended Cybersecurity Act entered into force on publication in State Gazette No. 17. Registration of essential and important entities, incident reporting and management accountability all began then. Fines reach 10 million euro or 2 percent of worldwide turnover for essential entities, and 7 million euro or 1.4 percent for important entities, with stated minimums of 25,000 euro and 12,500 euro. Supervisory practice is new and untested. 1 January 2026 — Bulgaria adopted the euro. Every monetary threshold and fine expressed in Bulgarian lev must now be read in euro at the fixed rate of 1.95583 lev to the euro. Contracts, retention schedules and accounting systems all had to be converted. 2 August 2026 — the European Union Artificial Intelligence Act's transparency obligations started applying. DORMANT SWITCHES — powers already held that could change the picture with no consultation. 1. The Electronic Communications Act's access regime keeps being widened by ordinary amendment and then trimmed by the Constitutional Court. Parliament can add a new authorised requester to the list of bodies that may pull six months of connection records in a single amending act. 2. The Gambling Act's control-local-server rule sits in primary legislation and its scope depends on what counts as a licensed online organiser. Extending the licence perimeter extends the localisation. 3. Defence and national security processing is carved out of the Personal Data Protection Act entirely by Article 1(5) 'in so far as a special law does not provide otherwise', so a special law can move a category of processing out of the general regime. AT EUROPEAN LEVEL, NOT ADOPTED — do not plan around these: the Digital Omnibus proposal of 19 November 2025 (which would extend breach notification from 72 to 96 hours), the Cloud and AI Development Act proposed 3 June 2026, and the European cloud certification scheme, deadlocked since 2020.