Bulgaria Personal Data Protection Act (ZZLD) - GDPR National Implementation

What Bulgaria Personal Data Protection Act (ZZLD) - GDPR National Implementation requires

Bulgaria's Закон за защита на личните данни (ZZLD - Personal Data Protection Act), as substantially amended by Darzhaven Vestnik (Official Gazette) Act SG 17/2019 of 26 February 2019 to align with the EU General Data Protection Regulation, is Bulgaria's primary national legislation supplementing the EU General Data Protection Regulation (GDPR - Regulation (EU) 2016/679) in Bulgaria. The GDPR is directly applicable Bulgarian law by virtue of Bulgaria's EU membership. The 2019 amendments (SG 17/2019) restructured the ZZLD to incorporate national derogations and additions permitted by the GDPR, replacing provisions now governed directly by the GDPR. The ZZLD was originally enacted in 2002 and has been amended multiple times to reflect evolving EU data protection law. Enforcement: the Комисия за защита на личните данни (KZLD - Commission for Personal Data Protection) is Bulgaria's independent data protection supervisory authority. The KZLD is Bulgaria's representative on the European Data Protection Board (EDPB) and participates in the EDPB's one-stop-shop mechanism for cross-border processing. Bulgaria is a Southeastern European EU member state with a growing IT outsourcing sector and significant cross-border data flows; Bulgaria has not yet adopted the euro and operates under the lev (BGN), which is pegged to the euro. Key Bulgarian national provisions: (1) Age of digital consent: Bulgaria has set the age of consent for information society services at 14 years (GDPR Art. 8 permits member states to set between 13 and 16); data subjects under 14 require parental or guardian consent; (2) Employment - the Bulgarian Labour Code (Kodeks na Truda, State Gazette 26/1986 as amended) and the Act on Health and Safety at Work govern employment relationships and employee data processing alongside GDPR; (3) Freedom of expression - exemptions for journalistic, literary, and artistic processing aligned with GDPR Art. 85 and Bulgarian constitutional freedom of expression; (4) Health data - specific provisions for health data processing under Bulgarian health legislation supplementing GDPR Art. 9; (5) Criminal data - the ZZLD restricts private entity processing of criminal conviction and offence data; (6) Public sector - Bulgarian public authorities are subject to both the ZZLD and Bulgarian administrative law. Fines: GDPR administrative fines apply in Bulgaria - up to EUR 20 million or 4% of global annual turnover. The KZLD has imposed administrative fines and issued enforcement decisions, including in employment, public sector, and direct marketing contexts.

Pillar: Data Protection & Privacy · Authority: Комисия за защита на личните данни (KZLD - Commission for Personal Data Protection, Bulgaria) · Version: 1.0.0 · Last updated: 2026-04-27

Primary source: https://www.cpdp.bg/

SHA-256 integrity: f36e6d842bdbbe834ece5685bdcc9dc0c50281102a259e6b13a503bda6d8a3d3

Primary Citations — 6 traced to source

• Закон за защита на личните данни (ZZLD - Personal Data Protection Act, Bulgaria, as amended by SG 17/2019 of 26 February 2019) - supplements EU GDPR; national derogations: age of digital consent 14 years; EGN (unified civil number) sensitive processing requirements; criminal data restrictions for private entities; research and statistics derogations; freedom of expression exemptions; originally enacted 2002, substantially amended 2019
• EU GDPR (Regulation (EU) 2016/679) - directly applicable in Bulgaria; fines up to EUR 20 million or 4% of global annual turnover; KZLD is Bulgaria's supervisory authority and EDPB member; 72-hour breach notification to KZLD under Art. 33; DPIA mandatory for high-risk processing under Art. 35; KZLD enforcement in employment, public sector, and direct marketing sectors

+ 4 more citations (full bibliography, deterministic workflow, actionable schema and crosswalks) included in the vault unlock — $0.01 via Skyfire / L402 / Direct Base USDC.

Access

• Discovery (free): /api/v1/nodes/bg-zzld-gdpr-2019.json — 6-field metadata
• Vault (full node): /api/v1/vault/nodes/bg-zzld-gdpr-2019.json — full 13-key payload, $0.01 USDC (L402/Skyfire/Direct Base)
• Canonical URL: https://bidda.com/intelligence/bg-zzld-gdpr-2019
• Back to registry: Browse all 10,090 compliance nodes