What Is PDPA? Personal Data Protection Act (PDPA)
Bulgaria's Personal Data Protection Act (PDPA) was enacted on 21 December 2001 and entered into force on 1 January 2002. Bulgaria is an EU member state, so the GDPR applies directly, with the PDPA providing national rules and targeted modifications. The current CPDP Bulgarian statutory text records amendments through State Gazette issue 69/2026, while the published English consolidated text remains through State Gazette 70/2024. The currentness boundary is therefore language-specific: the Bulgarian text is the current primary record, while the English rendering is not fully current and should not be treated as a complete translation of the 2026 amendments. The source conflict over humanitarian or disaster processing is resolved by the official Bulgarian statutory text: the rule is Article 25o, not Article 25n, and it says GDPR Articles 12-21 and 34 do not apply in the described processing. The CPDP English HTML rendering's contrary wording appears to be a numbering and translation/rendering error; the Bulgarian statutory text controls.
At a glance
- Full name
- Personal Data Protection Act (PDPA)
- Short code
- PDPA
- Jurisdiction
- Bulgaria
- Enacted
- 2001
- Last major update
- The current CPDP Bulgarian statutory text records amendments through State Gazette issue 69/2026, including Article 7(4); the CPDP English consolidated text remains through State Gazette 70/2024 and is not fully current
- Regulator
- Commission for Personal Data Protection (CPDP)
- Private right of action
- Limited
- Statutory citation
- Personal Data Protection Act (PDPA)
Scope, who PDPA covers
Protected data
Data subject rights
GDPR transparency and information rights under Articles 12-14, subject to PDPA Article 37a and targeted exceptions
Right of access under Article 15, with exclusions or refusals for specified archival, statistical, journalism, expression, humanitarian, and disaster processing
Right to rectification under Article 16, subject to corresponding statutory exceptions
Right to erasure under Article 17, subject to applicable exceptions and Article 37a restrictions
Right to restriction of processing under Article 18, subject to specified archival, statistical, journalism, expression, humanitarian, and disaster rules
Right to data portability under Article 20, subject to statutory exclusions and refusals
Right to object under Article 21, subject to specified archival, statistical, journalism, expression, humanitarian, and disaster rules
For humanitarian or disaster processing under PDPA Article 25o, the official Bulgarian text states that GDPR Articles 12-21 and 34 do not apply; this controls over the conflicting CPDP English rendering
Protection concerning automated decision-making under Article 22; no express disapplication was located in the listed Article 25h, 25k, 25l, or 25n provisions
Right to complain to the CPDP within 6 months of becoming aware of an infringement and no later than 2 years after it occurred; current CPDP guidance requires Bulgarian-language filing with complainant, controller, violation, and signature details, and requires a qualified electronic signature for email filings
Right to appeal a CPDP decision within 14 days of receipt under the Administrative Procedure Code
Notable features
Bulgaria combines directly applicable GDPR rights with national PDPA derogations for journalism and expression, archival processing, statistics, and humanitarian or disaster processing. The former Article 25h(2) balancing criteria were declared unconstitutional by Constitutional Court Decision No. 8/2019. The principal currentness trap is the CPDP consolidated text’s omission of identified 2026 amendments; the official Bulgarian text resolves the former CPDP HTML/PDF conflict by placing the humanitarian/disaster rule in Article 25o and disapplying GDPR Articles 12-21 and 34.
Enforcement & penalties
Regulator: Commission for Personal Data Protection (CPDP)
Penalties: GDPR Article 83 applies directly: up to €10 million or 2% of annual worldwide turnover for Article 83(4) violations, and up to €20 million or 4% of annual worldwide turnover for Article 83(5) violations. PDPA Article 85 assigns specified PDPA violations to the GDPR Article 83(4) or 83(5) amounts using Article 83(2) criteria. No separate universal Bulgarian fine schedule limited to public bodies, and no general public-body fine exemption, was located.
Private right of action: The CPDP complaint process, its three-month progress or outcome notification, and a 14-day appeal route under the Administrative Procedure Code are the identified mechanisms. A general private damages route was not described in the reviewed report.
Relevance to data brokers
Not located. No dedicated data-broker or public-record deletion route, including for data associated with the Commercial Register, was located. The identified mechanisms are the general GDPR and PDPA rights and the CPDP complaint route. Current CPDP guidance requires Bulgarian-language complaints or alerts with complainant, controller, violation, and signature details; email filings must be qualified-electronic-signature documents. These filing rules do not create a broker-specific route.
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
FAQ
Is Bulgaria’s privacy-law text fully current?+
The CPDP Bulgarian statutory text records amendments through State Gazette issue 69/2026, including Article 7(4). The CPDP English consolidated page lists amendments only through State Gazette 70/2024, so the Bulgarian text controls for the 2026 amendments and the English rendering should be treated as incomplete.
Which version applies to humanitarian or disaster processing?+
The official Bulgarian statutory text controls: PDPA Article 25o says that processing for humanitarian purposes by public authorities or humanitarian organisations, and processing in disasters, is lawful, and that GDPR Articles 12-21 and 34 do not apply in those cases. The CPDP English HTML rendering says the opposite and labels the provision Article 25n; that rendering is not treated as authoritative here.
Can I complain to Bulgaria’s data-protection regulator?+
Yes. Complaints or alerts must be submitted in Bulgarian through the stated CPDP channels, including in person, post, fax, qualified-e-signature email, or secure e-service. The complaint must identify the sender, nature of the complaint, controller, and relevant date where applicable; email complaints must be qualified-electronic-signature documents. The filing window is 6 months after becoming aware of the infringement and no later than 2 years after it occurred.
Does Bulgaria have a dedicated data-broker deletion route?+
Not located. No dedicated data-broker or public-record deletion route was located in the reviewed materials. The identified mechanisms are the general GDPR and PDPA rights and the CPDP complaint process.
Official sources & citations
Other international privacy regimes
PDPA sits in a global ecosystem of data-protection laws. Start with these comparative frameworks, or visit the privacy research hub for the complete jurisdiction index: