Bulgaria

The Personal Data Protection Act (Закон за защита на личните данни, promulgated in State Gazette No. 1 of 4 January 2002, comprehensively rewritten by State Gazette No. 17 of 26 February 2019) says in Article 1(1) that it governs matters 'in so far as they are not governed by Regulation (EU) 2016/679'. So the General Data Protection Regulation does the heavy lifting on who is covered, through its Article 3. The Bulgarian Act adds national rules on top. Two Bulgarian points matter here. Article 1(7) treats the European Economic Area states AND Switzerland as equal to European Union member states. So a transfer to Switzerland is not a transfer to a third country under Bulgarian law at all. Article 1(6) leaves out data about dead people, except for the narrow case in Article 25e. Article 1(5) leaves out national defence and national security work, unless a special law says otherwise. There is no registration or licensing step before you may use personal data. But Article 25b applies to every company, and to every supplier that handles data for them. You must tell the regulator your data protection officer's name, Bulgarian personal identification number and contact details. You must also report any later change.

Industry by industry, checked 18 August 2026. ONLINE GAMBLING — a copy must stay in the country The Gambling Act (Закон за хазарта) Article 6(1)(2) covers the communications equipment and the central point housing the central computer system. Both must be in Bulgaria or another European Union member state. Article 6(4) goes further. ALL data must be stored on a data storage device, a 'control local server', located on the territory of the Republic of Bulgaria. Article 6(2) says 'territory of the Republic of Bulgaria' means only the geographic territory of the country. Article 6(1)(4) requires a system feeding session information in real time to a server of the National Revenue Agency. This is the only strict keep-it-in-Bulgaria rule we found. TELECOMS — data can leave only if conditions are met in law, but Bulgarian equipment on the ground. The Electronic Communications Act (Закон за електронните съобщения) Article 251b makes providers of public electronic communications networks or services keep six categories of connection data for six months. The Act does NOT say where that data must sit. But Articles 304, 305 and 307 make operators provide, install and maintain interception interfaces at their own expense. Those interfaces feed the State Agency for Technical Operations and the State Agency for National Security. Operators must also hand over encrypted traffic in its original form. That is a duty to build physical equipment in Bulgaria, not a rule about where data lives. BANKING, PAYMENTS, INSURANCE, SECURITIES — data can leave only if conditions are met We found no Bulgarian rule about where data must sit, checked 18 August 2026. The Credit Institutions Act Article 62 imposes bank secrecy. That restricts WHO may see data, not WHERE it sits. The European Union's Digital Operational Resilience Act governs outsourcing. It requires the contract to say where data is handled, but it does not require data to stay in any country. HEALTH — data can leave only if conditions are met We found no rule forcing data to stay in Bulgaria. The National Health Information System is a central state system run by the Ministry of Health. So state-held electronic prescription and referral data is in Bulgaria by design. Private clinics are not told where to host their own records. GOVERNMENT — data can leave only if conditions are met The Electronic Governance Act defines a 'State hybrid private cloud' as central state infrastructure. The State Agency, and later the Ministry of Electronic Governance, build and share it. Neither that Act nor the ordinance on general requirements for information systems says public bodies' data must stay in Bulgaria. Public buying rules push systems into the state cloud anyway. MAPPING AND GEOSPATIAL — data can leave only if conditions are met, with a permit before you collect. The Geodesy and Cartography Act Article 15(2) requires aerial photography and other remote-sensing work to be cleared in advance. Five bodies must clear it: the Ministry of Defence, the Ministry of the Interior, the State Agency for National Security, the Ministry of Foreign Affairs and the transport ministry. Article 20 requires state-commissioned survey material to be deposited in the state Geo-Cartographic Fund. Article 21 keeps aerial films, digital aerial data and satellite imagery there indefinitely. EDUCATION, ECOMMERCE, SOCIAL MEDIA, DEFENCE — we found no separate Bulgarian rule forcing data to stay in the country, checked 18 August 2026. Defence and national security work is left out of the Personal Data Protection Act entirely and is handled under classified information law.

The model is: you can only send data to approved countries, and the approving is done at European Union level. The list is well populated. As verified against the European Commission's own list on 18 August 2026, the approved destinations are: Andorra, Argentina, Brazil (new, 26 January 2026, mutual), Canada (commercial organisations only), the Faroe Islands, Guernsey, the Isle of Man, Israel, Japan, Jersey, New Zealand, South Korea (first review confirmed 23 July 2026), Switzerland, the United Kingdom (renewed 19 December 2025, running to 2031), Uruguay, the United States for entities self-certified under the EU-US Data Privacy Framework, and the European Patent Organisation. None has been withdrawn or suspended. Outside that list, the 2021 Standard Contractual Clauses (Decision (EU) 2021/914) are the main tool and remain unchanged. The promised new clauses, for importers already directly caught by the Regulation, are still not adopted as of 18 August 2026. Binding Corporate Rules remain available. The Article 49 exceptions are narrow and are not a route for routine or large-scale transfers. You are still expected to write a transfer impact assessment. The EU-US Data Privacy Framework is in force and legally valid on 18 August 2026, but under pressure. The Latombe challenge was dismissed by the General Court on 3 September 2025 and has been on appeal to the Court of Justice since 31 October 2025. On 31 July 2026 the European Data Protection Board formally asked the Commission to examine whether changes in United States institutions affect the decision's validity. The Commission has not suspended or revoked it. Bulgaria adds nothing on top. The Personal Data Protection Act has no separate transfer chapter for ordinary business and no rule that data must stay in the country. Its Article 1(7) does add that European Economic Area states and Switzerland rank equal to European Union member states.

The Commission for Personal Data Protection (Комисия за защита на личните данни) is set up under Chapter Two of the Personal Data Protection Act. It is the supervisory authority for the General Data Protection Regulation in Bulgaria. It is working. It issues administrative acts, its decisions have been published through the European Data Protection Board's document library, and it took part in the Board's 2025 coordinated enforcement action. That action is also the clearest recent sign of how it behaves. In the national report published by the Board in February 2026, Bulgaria reported contacting twenty-three companies: six public sector, sixteen private sector, and one military education body. All of them replied. Bulgaria then answered 'no' to whether it planned formal investigations, and 'no' to whether the exercise would change its enforcement work. It said it would run an information campaign instead. Enforcement acts are taken by decision of the Commission, and penalty orders are issued by its chair, under Articles 84 to 87 of the Act. Appeals go to the administrative courts within fourteen days. A second, separate supervisor exists. The Inspectorate to the Supreme Judicial Council oversees how courts, prosecutors and investigators handle data. Cybersecurity is supervised by the Minister of Electronic Governance, together with the regulator for each industry, under the amended Cybersecurity Act. Gambling, including the local-server rule, is supervised by the National Revenue Agency. One thing worth knowing: the Commission's own website was unreachable from our infrastructure on 18 August 2026, returning a server error every time. So we could not read its 2025 annual report figures directly, and they are on the unconfirmed list.

MINIMUM KEEPING PERIODS. The Accountancy Act (Закон за счетоводството, State Gazette No. 95 of 8 December 2015, last amended State Gazette No. 61 of 2025 in force 31 October 2025) Article 12(1) sets three periods. All are counted from 1 January of the reporting period following the one they relate to. Payroll sheets: fifty years. Accounting registers and financial statements, including documents for tax control, audit and later financial inspections: ten years. All other carriers of accounting information: three years. Article 12(1) says this information is kept 'in the enterprise', on paper and/or a technical medium. Article 12(2) allows storage in private or state archives under the National Archive Fund Act. Article 12(4) sends payroll sheets to the National Social Security Institute if a company is wound up with no successor. The Electronic Communications Act Article 251b(1) requires six months for six categories of connection data. The Gambling Act Article 6(4) requires gambling data to be kept in the form in which it was created. The period is five years after the limitation period for public liabilities expires. Article 6(5) sets a minimum of at least twelve months from collection. The Geodesy and Cartography Act Article 21(3) requires carriers of field measurement data to be kept fifty years. Article 21(2) keeps aerial films, digital aerial data and satellite imagery indefinitely in the state Geo-Cartographic Fund. DELETION DEADLINES. Personal Data Protection Act Article 25k(1): an employer must set a keeping period for job candidates' data. It cannot be longer than six months unless the candidate agrees to longer. After that the documents must be erased or destroyed, unless a special law says otherwise. Article 25k(2): originals or notarised copies of fitness, qualification and service-record documents must be returned to unsuccessful candidates within six months of the procedure closing. Article 25a: where data was handed over with no lawful basis, or against the principles of the European rulebook, you must return it within one month of finding out. If returning it is impossible or disproportionate, you erase or destroy it, and you must write the erasure down. The European rulebook's general rule against keeping data longer than you need it applies throughout. WHEN THE RULES CLASH. Bulgarian drafting settles it in favour of the specific statutory minimum. Article 25k twice carries the phrase 'unless a special law provides otherwise'. So keep the record for the statutory minimum, then delete it.

Deadline one: the General Data Protection Regulation, Article 33. Tell the Commission for Personal Data Protection without undue delay, and where possible within 72 hours of becoming aware. Tell the people affected without undue delay where the risk to them is high. This is the deadline that catches most organisations. Deadline two: the Cybersecurity Act as rewritten by the Act published in State Gazette No. 17 of 13 February 2026. It brings in the European network and information security directive known as NIS2. For a significant incident, an essential or important entity must send an early warning within 24 hours of establishing the incident, and an incident notification within 72 hours. Qualified trust service providers must send that notification within 24 hours. The old 2018 text demanded an early warning within two hours and a full report within five working days. It has been replaced. The Minister of Electronic Governance keeps the register of covered entities, and the regulator for each industry supervises. Deadline three: for financial firms, Regulation (EU) 2022/2554, the Digital Operational Resilience Act, has applied since 17 January 2025. It adds its own initial, intermediate and final report deadlines. It is a specialist set of rules that takes precedence over general national information technology rules for those firms. The overlap is where organisations fail. One incident at a bank can be a personal data breach, a significant cybersecurity incident and a major financial technology incident all at once. That means three different recipients and three different formats.

Trap 1 — no copying identity documents. Personal Data Protection Act Article 25g: you may copy an identity card, a driving licence or a residence document only where a law provides for it. That binds you and any supplier handling data for you. Foreign 'take a photo of your passport' sign-up flows walk straight into this. A breach carries the higher European fine tier under Article 85(2). Trap 2 — children's age is fourteen. Article 25c requires a parent's or guardian's consent where you rely on consent for anyone under fourteen. That includes direct offers of information society services. Bulgaria chose the lowest age the European rulebook permits. So a global product built to sixteen does more than Bulgaria requires, and one built to thirteen breaks the rules here. Trap 3 — the six-month recruitment limit. Article 25k(1) caps how long you may keep unsuccessful candidates' data at six months, unless they agree to longer. Article 25k(2) forces return of original or notarised documents within six months. Applicant tracking systems set to a two-year default breach this. Trap 4 — a dead clause still printed in the law. Article 25z(2) sets out ten criteria for balancing free expression against privacy in journalism. The Constitutional Court declared it unconstitutional by Decision No. 8 of 2019, published in State Gazette No. 93 of 26 November 2019. The text remains in the consolidated statute with only a bracketed note. Article 85(2) still lists 'Article 25z, paragraphs 1 and 2' among the punishable breaches. A plain text search reads this as binding. It is not. Trap 5 — a language requirement on your systems, and duties on named people. Accountancy Act Article 11(2): where accounting software is used, it must be built to this Act's requirements. It must also allow the data it handles and its output documents to be in the Bulgarian language. Separately, Personal Data Protection Act Article 25b makes you tell the regulator about your data protection officer. You give their name, their Bulgarian personal identification number (or the equivalent for a foreigner) and contact details. You must also report every later change. Article 25i makes employers adopt and publish written rules and procedures for whistleblowing systems, for restrictions on internal company resources, and for any access-control, working-time or discipline-monitoring systems. Article 25zh(2) bans using the Bulgarian personal identification number as the only way of identifying a user for remote access to an online service.

DATED AND CERTAIN. 12 January 2027 — the European Data Act (Regulation (EU) 2023/2854) has applied since 12 September 2025. From this date it requires all cloud switching charges and data egress fees to fall to zero. Its Chapter VII also limits foreign government access to non-personal data held in the European Union. 13 February 2026 — Bulgaria's amended Cybersecurity Act came into force on publication in State Gazette No. 17. Registration of essential and important entities, incident reporting and management accountability all began then. Fines reach 10 million euro or 2 percent of worldwide turnover for essential entities, and 7 million euro or 1.4 percent for important entities. The stated minimums are 25,000 euro and 12,500 euro. Supervision here is new and untested. 1 January 2026 — Bulgaria adopted the euro. Every money threshold and fine written in Bulgarian lev must now be read in euro, at the fixed rate of 1.95583 lev to the euro. Contracts, deletion schedules and accounting systems all had to be converted. 2 August 2026 — the European Union Artificial Intelligence Act's transparency duties started applying. POWERS ALREADY HELD THAT COULD CHANGE THINGS WITH NO CONSULTATION. 1. The Electronic Communications Act's access rules keep being widened by ordinary amendment and then trimmed by the Constitutional Court. Parliament can add a new authorised requester to the list of bodies that may pull six months of connection records, in a single amending act. 2. The Gambling Act's control-local-server rule sits in primary legislation. Its reach depends on what counts as a licensed online organiser. Widening the licence net widens the requirement to keep data in Bulgaria. 3. Article 1(5) leaves defence and national security work out of the Personal Data Protection Act entirely. The wording is 'in so far as a special law does not provide otherwise'. So a special law can move a category of work out of the general rules. AT EUROPEAN LEVEL, NOT ADOPTED — do not plan around these. The Digital Omnibus proposal of 19 November 2025, which would extend breach notification from 72 to 96 hours. The Cloud and AI Development Act proposed 3 June 2026. And the European cloud certification scheme, deadlocked since 2020.