LAW FOR PROTECTION OF THE PERSONAL DATA
Prom. SG. 1/4 Jan 2002, amend. SG. 70/10 Aug 2004, amend. SG. 93/19 Oct 2004, amend. SG. 43/20 May 2005, amend. SG. 103/23 Dec 2005, amend. SG. 30/11 Apr 2006, amend. SG. 91/10 Nov 2006, amend. SG. 57/13 Jul 2007, amend. SG. 42/5 Jun 2009, amend. SG. 94/30 Nov 2010, amend. SG. 97/10 Dec 2010
Chapter one.
GENERAL
Art. 1. (amend. - SG 103/05) (1) This law settles the protection of rights of the individuals in processing their personal data.
(2) The prospective of the law is guaranteeing the inviolability of the individual and the personal life by providing protection of the individuals in illegal processing of personal data related to them in the process of free movement of the data.
(3) (new - SG 91/06) This Law shall be applied to processing of personal data by:
1. automatic means;
2. non-automatic means provided that the data constitutes or is intended to constitute part of a register.
(4) (prev. text of para 03, amend. - SG 91/06) This law shall be applied to processing of personal data where the administrator of personal data:
1. (amend. - SG 91/06) is settled on the territory of the Republic of Bulgaria and processes personal data in relation to his activity;
2. (amend. - SG 91/06) is not settled on the territory of the Republic of Bulgaria, but is obliged to apply this Law on the grounds of the international public law;
3. (in force from the date of entering into force of the Pre-accession agreement of the Republic Bulgaria to the European Union; amend. - SG 91/06) is not settled on the territory of a Member State of the European Union, as well as in another state – member of the European Economic Area, but for the purposes of the processing uses means, located on the Bulgarian territory, except these means are used for transit purposes only; in this case the administrator shall point a representative, settled on the territory of the Republic of Bulgaria, without discharging him/her this way from liability.
(5) (prev. text of para 04, amend. - SG 91/06) This Law shall be applied also to the processing of personal data for the needs of the defence, the national security and the public order, as well as for the needs of the penal proceedings unless otherwise provided by a special law. Processing of the data shall be performed under control by the respective state body.
(6) (prev. text of para 05 - SG 91/06) The terms and procedure for the procession of unified civil number and other identification numbers of general application shall be settled by special laws.
(7) (prev. text of para 06 - SG 91/06; suppl. – SG 57/07, in force from 13.07.2007) This law shall not be applied for the procession of personal data, performed by natural persons for their personal or household needs, neither for information, being kept in the National archive fund.

Art. 2. (suppl., - SG 70/04; amend. - SG 103/05) (1) (amend. - SG 91/06) Personal data shall be any information related to a natural person, who is identified or may be identified directly or indirectly by an identification number or though one or more specific indices.
(2) The personal data shall be:
1. processes lawfully and in good faith;
2. collected for concrete, precisely defined and lawful purposes and shall not be processed additionally in a manner incompatible with these purposed; the additional processing of the personal data for historical, statistic or scientific purposes shall be admissible under the condition that the administrator provides appropriate protection guaranteeing that the data will not be processed for other purposes; 
3. (amend. - SG 91/06) proportional, related to and non-exceeding the purposes, which they are processed for;
4. precise and in case of necessity to be updated;
5. deleted or corrected where is found that they are incorrect or not proportional with regard to the purposes for which they are processed;
6. maintained in a status, which allows identification of the respective natural persons for a period not longer for the purposes, for which these data is processed; the personal data, which is kept for a longer period for historical, statistic or scientific purposes, shall be kept in a status, not allowing identification of the natural persons.

Art. 3. (1) (amend. – SG 103/05; amend. - SG 91/06) Administrator of personal data, referred hereinafter as "administrator", shall be is a natural or legal person, as well as a body of state power or local government, that independently or jointly with another person determines the purposes and means of processing personal data.
(2) (new – SG 103/05; amend. - SG 91/06) Administrator shall also be a natural person or a legal person, as well a body of state power or local government processing personal data the type, the purposes and means of processing of which are determined by a law. In such cases the administrator or the specific criteria of his appointment shall be normatively specified.
(3) (prev. text of Para 2 – SG 103/05) The administrator of personal data shall process the personal data independently or through assignment to a processor of the data.
(4) (new - SG 103/05) The administrator shall provide the observation of the requirements of Art. 2, Para 2.

Art. 4. (amend. – SG 103/05) (1) The processing of personal data shall be admissible only in the cases, where at least one of the following conditions exist:
1. the procession is needed for execution of a settled by law obligation of the administrator of the personal data;
2. the natural person to whom the data refers has given explicitly his/her consent;
3. (amend. - SG 91/06) the processing is needed for performance of obligations of a contract in which the natural person to whom the data refers is a party as well as for actions preceding the conclusion of a contract and undertaken at his request;
4. the processing is needed to protect the live and health of the natural person to whom the data refers;
5. the procession is needed for fulfillment of a task which is performed in the interest of the public;
6. the processing is needed for exercising of powers assigned by a law to the administrator or to a third person, to whom the data is disclosed;
7. the procession is needed for realization of the legal interests of the administrator of personal data and of a third person, to whom the data is disclosed, except in case the interests of the natural person, whom the data refers to, prevail.
(2) Procession of personal data shall also be admissible in the cases where it is performed only for the purposes of journalistic, literature or artistic expression, as far as this procession does not violate the right of private live of the person whom the data refers to. In these cases the provisions of Chapter Five shall not be applied.

Art. 5. (amend. – SG 103/05) (1) Prohibited shall be the processing of personal data, which:
1. disclose racial or ethnical origin;
2. disclose political, religious or philosophical convictions, membership in political parties or organizations, associations of religious, philosophical, political or trade-union purposes;
3. are related to the health, sexual live or the human genome;
(2) Para 1 shall not be applied, if:
1. the procession is needed for the purposes of the execution of specific rights and obligations of the administrator in the field of the labour legislation;
2. (suppl. - SG 91/06) the natural person whom the data refers to has explicitly given his/her consent for their procession, except in a special law provided otherwise;
3. the procession is needed for the protection of live and health of the natural person whom the data refers to, or to another person and the status of the natural person does not allow to give consent or legal obstacles exist for this;
4. the procession is performed by a non-profit organization, including religious, philosophical, political or trade-union purpose, within its lawful activity and with appropriate protection, under the condition that:
a) the procession is connected only with the members of this organization or with persons, who maintain regular contacts with it in relation to its purposes;
b) the data is nor disclosed to third persons without the consent of the natural person whom the data refers to;
5. the processing is related to data, publicly announced by the natural person or this is needed for the finding, exercising and the protection of rights under court procedure;
6. the processing is needed for the purposes of the preventive medicine; the medical diagnostics, the providing and management of medical services, under the condition that the data is processed by a medical expert, obliged by a law to keep the professional secret or by another person, bound with a similar obligation to keep secret;
7. the processing is performed only for the purposes of journalistic, literature or artistic expression, as far as this procession does not violate the right of private live of the person whom the data refers to.

Chapter two.
COMMISSION FOR PROTECTION OF THE PERSONAL DATA
Art. 6. (1) The Commission for protection of the personal data, called hereinafter "the commission" is an independent state body carrying out protection of the individuals in processing their personal data and in providing the access to these data, as well as the control over the observance of this law.
(2) (new – SG 94/10) The Commission shall assist the implementation of the state policy in the field of protection of personal data
(2) (suppl. - SG 91/06, in force from 01.01.2007; prev. text of Para 02 – SG 94/10) The commission shall be a legal person at budget support and headquarters in Sofia and shall be a primary administrator of budget credits.

Art. 7. (1) The commission is a college body and consists of a chairman and 4 members.
(2) (amend. - SG 91/06) The members of the commission and its chairman shall be elected by the National Assembly upon proposal of the Council of Ministers for a period of 5 years and they can be re-elected for another mandate.
(3) The chairman and the members of the commission shall carry out their activity under legal terms of employment.
(4) (new - SG 91/06) The members of the Commission shall receive basic monthly salary equal to 2,5 average monthly working salaries of the persons employed under employment or official relationship in the public sector according to data of the National Statistical Institute. The basic monthly salary shall be recalculated each quarter taking into consideration the average monthly working salary for the last month of the preceding quarter.
(5) (new - SG 91/06) The Chairman of the Commission shall receive monthly salary exceeding by 30 percent the basic monthly salary referred to in Para 4.
(6) (amend. – SG 103/05; prev. text of para 04 - SG 91/06) The commission, by January 31 every year, shall present an annual report on its activity to the National Assembly.

Art. 8. (1) As members of the commission can be elected Bulgarian citizens who:
1. have higher education on informatics, law or who are masters on information technologies;
2. have time of service on the speciality no less than 10 years;
3. (amend. – SG 103/05) have not been convicted to imprisonment for deliberate indictable offences, not depending on if they have been rehabilitated;
(2) Members of the commission cannot be:
1. (amend. – SG 103/05) persons who are sole entrepreneurs, managers/procurators or members of managing or control bodies of trade companies, co-operations or administrators of personal data in the meaning of this law;
2. persons who occupy another paid position except when they practice scientific or lecturing activity;
3. (new – SG 42/09) persons who are souses or in factual cohabitation, relatives of direct lineage, of peripheral lineage of up to fourth degree or a relative-in-law – up to second degree inclusive, with another member of the commission.
(3) Elected as chairman of the commission shall be a qualified lawyer who meets the requirements of para 1 and 2.
(4) The mandate of the chairman or of a member of the commission shall be terminated ahead of term:
1. for reason of death or placing under judicial disability;
2. by a decision of the National Assembly when:
a) he has filed for release;
b) he has committed a gross infringement of this law;
c) he has committed a deliberate indictable offence for which a conviction has been enforced;
d) existing inability to fulfil his obligations for a period longer than six months;
e) (new – SG 42/09; amend. – SG 97/10, in force from 10.12.2010) if a conflict of interest has been found by an act that has come into effect pursuant to the Law on Prevention and Establishment of Conflicts Of Interest.
(5) (amend. and suppl. – SG 103/05) In the cases under para 3 the Council of Ministers shall propose to the National Assembly to elect a new member for the period until the end of the initial mandate of the respective member of the commission.
(6) The time during which the person has worked as chairman or a member of the commission shall be acknowledged as official time of service according to the Law for the civil servant.

Art. 9. (1) The commission is a permanently functioning body assisted by an administration.
(2) The commission shall settle by regulations its activity and the activity of its administration and shall promulgate it in the State Gazette.
(3) The decisions of the commission shall be taken by a majority of the total number of its members.
(4) The meetings of the commission shall be open. The commission can decide individual meetings to be closed.

Art. 10. (1) The commission shall:
1. analyse and exercise an overall control over the observance of the normative acts in the sphere of protection of the personal data;
2. (suppl. – SG 103/05) keep register of the administrators of personal data and of the kept by them registers of personal data;
3. carry out inspections of the administrators of personal data in connection with its activity under item 1;
4. express opinion and give permits in the cases stipulated by this law;
5. issue obligatory prescriptions for the administrators in connection with the protection of the personal data;
6. impose, upon prior notice, temporary prohibition of processing personal data which violates the norms of protection of the personal data;
7. (amend. – SG 103/05) consider claims against acts and actions of the administrators by which the rights of the natural persons are violated under this law, as well as of appeals of third persons in connection with their rights according to this law;
8. (amend. – SG 103/05) participate in the working out and obligatory give statements on drafts of law and secondary legislation acts in the field of the protection of personal data.
9. (new – SG 103/05, in force from the date of entering into force of the Pre-accession agreement of the Republic Bulgaria to the European Union) provide the application of the decisions of the European Commission in the field of the protection of the personal data.
10. (new – SG 94/10) participate in the activities of international organisations in the field of personal data protection;
11. (new – SG 94/10) participate in the negotiations and conclusion of bilateral or multilateral agreements in the field of its competency;
12. (new – SG 94/10) organise and coordinate the training of personal data administrators in the field of personal data protection.
(2) (amend. – SG 103/05) The order of keeping the register under Para 1, item 2 for notifying the commission for giving permits and expressing opinions. for considering the complaints, as well as for issuance of obligatory prescriptions and imposing temporary prohibition of processing personal data shall be determined by the regulations under art. 9, para 2.
(3) (suppl. – SG 103/05; amend. - SG 91/06) The Commission shall issue a bulletin publishing information for its activity and for the taken decisions. The report of Art. 7, Para 6 shall be published in the bulletin.
(4) (new – SG 103/05; amend. - SG 91/06) The Commission shall coordinate according to branches and fields of activity the codes of ethics of behaviour of the administrators of personal data referred to in Art. 22a and upon finding incompliance with the normative order shall issue normative instructions.

Art. 11. The chairman of the commission shall:
1. organise and manage the activity of the commission according to the law and the decisions of the commission and shall be responsible for the fulfilment of its obligations;
2. represent the commission before third persons;
3. (suppl. – SG 103/05) appoint and release the civil servants and conclude and terminate the employment contracts of the employees working under legal terms of employment in the administration after a decision of the commission.
4. (new – SG 103/05) issue penal decrees under Art. 43, Para 2.

Art. 12. (amend. - SG 91/06) (1) The chairman and the members of the commission or persons from the administration authorised by it shall carry out control by preliminary, current and subsequent inspections for observation of this Law.
(2) Preliminary inspection shall be performed in the cases referred to in Art. 17b.
(3) Current inspections shall be performed upon request of interested persons, as well as by the initiative of the commission, on the grounds of a monthly plan for control activity adopted by it.
(4) Subsequent inspections shall be performed for performance of a decision or a compulsory instruction of the Commission as well as under its initiative upon submitted notification.
(5) The inspecting persons shall legitimate themselves by an official’s card and order by the chairman of the commission for the respective inspection.
(6) At carrying out inspections, the persons of Para 1 may assign performance of expertises under the procedure of the Civil Procedure Code.
(7) The inspection shall end by an act of findings.
(8) In the cases where with the act referred to in Para 7 an offence was found, the act of findings shall be considered to be an act of finding administrative offence in the sense of the Law for the Administrative Offences and Sanctions.
(9) The conditions and the order of performing the control shall be determined by an Instruction of the Commission.

Art. 13. (1) (amend. - SG 103/05) The chairman and the members of the commission and the employees of its administration shall be obliged not to make public and not to use for their or somebody’s else benefit the information representing a secret protected by law for the administrators of personal data which has become known to them in fulfilment of their activity, till the elapse of the period pf its protection.
(2) In taking office persons under Para 1 shall file declarations for their obligations under para 1 and 2.

Art. 14. (amend. - SG 103/05) (1) In the register under Art. 10, para 1, item 2 shall inscribed the d under Art. 18, Para 2.
(2) The inscription in the register under Art. 10, Para 1, item 2 shall be certified by identification number.
(3) The register under para 1 shall be public

Art. 15. (revoked – SG 103/05)

Art. 16. (amend. - SG 103/05; revoked – SG 91/06)

Chapter three.
OBLIGATIONS OF THE ADMINISTRATOR OF PERSONAL DATA (TITLE AMEND. – SG 103/05)
Art. 17. (amend. - SG 103/05; amend. - SG 91/06) (1) The administrator of personal data shall be obliged to submit an application for registration before starting to process personal data.
(2) Within a term of 14 days from submission of the application the Commission shall enter the administrator of personal data in the register referred to in Art. 10, Para 1, Item 2.
(3) The administrator may start processing of the data after submission of the application for registration.

Art. 17a. (new - SG 91/06) (1) Application for registration shall not be submitted if the administrator:
1. keeps a register which according to a normative act is intended to provide public information and:
a) the access to it is free or
b) access to it has any person of legal interest;
2. processes data in the cases referred to in Art. 5, Para 2, Item 4.
(2) The Commission may exempt form obligation for registration also administrators processing data besides those referred to in Para 1, provided that the processing does not endanger on the rights and the legal interests of the persons whose data is being processed.
(3) The conditions and the order of exemption under Para 2 shall be established by the Regulation referred to in Art. 9, Para 2 and the Commission shall determine the criteria in compliance with:
1. the purposes of processing personal data;
2. the personal data or the categories personal data subject to processing;
3. the categories natural persons whose data is being processed;
4. the recipients or the categories recipients to whom the personal data may be revealed;
5. the term of storage of the data.

Art. 17b. (new - SG 91/06) (1) Where the administrator has applied for processing of data under Art. 5, Para 1 or data processing of which according to a Decision of the Commission endangers the rights and the legal interests of natural persons, the Commission shall obligatorily perform a preliminary inspection before entering into the register referred to in Art. 10, Para 1, Item 2.
(2) The preliminary inspection shall be performed within a term of two months from submission of the application for registration referred to in Art. 17, Para 1.
(3) After the end of the preliminary inspection the Commission shall:
1. enter the administrator of personal data into the register;
2. give compulsory instructions concerning the conditions of processing of personal data and keeping a register of personal data;
3. reject the entrance.
(4) The administrator may not start processing of personal data before being entered into the register under Art. 10, Para 1, Item 2 or before performing the compulsory instructions of the Commission.
(5) The absence of pronouncement by the Commission within the term referred to in Para 2 shall be considered tacit refusal to enter the administrator into the register.
(6) The dispositive part of the Decision referred to in Para 1 shall be promulgated in the State Gazette.

Art. 18. (amend. – SG 103/05) (1) (amend. - SG 91/06) The administrator or a representative of the administrator shall submit application for registration under Art. 17, Para 1 and documents as per form, approved by the commission.
(2) The application shall contain:
1. the data identifying the administrator of personal data and his/her representative, if such exists;
2. the purposes of the personal data processing;
3. the categories natural persons whose data is processed and the categories of personal data related to them;
4. the receivers or the categories of receivers, to whom the personal data can be disclosed;
5. offered providing of personal data in other countries;
6. the general description of the measures, undertaken as per Art. 23, allowing to make out a preliminary assessment of their expedience;
(3) The administrator shall notify the commission about each change in the data under Para 2 before its execution. In the cases where such change is provided by a law, the notification shall be performed within 7-days term from the entering in force of the relevant law.
(4) In the cases where the administrator is not inscribed in the register under Art. 10, Para 1, item 2 he/she shall be obliged to provide the data under Para 2 to every person upon request.

Art. 19. (suppl. SG 92/04; amend. - SG 103/05) (1) (amend. - SG 91/06) In the cases where the personal data is collected by the person they refer to, the administrator or his representative shall provide to him/her:
1. the data which identifies the administrator and his/her representative.
2. the purpose and the resources for their processing;
3. the recipients or the categories of recipients to whom the data can be submitted and the sphere of their using;
4. the obligatory or voluntary nature of submission of the data and the consequences from a refusal of submission;
5. the right to access and to correction of the gathered data, 
(2) The information under para 1 shall not be provided, if the natural person the data refers to, already has it or in a law exists explicit prohibition to provide it.

Art. 20. (amend. - SG 103/05) (1) (amend. - SG 91/06) Where the personal data is not obtained from the natural person whom they refer to, the administrator or a representative of the administrator shall provide to him:
1 the data which identifies the administrator and his/her representative.
2. the purpose and the resources for their processing;
3. the recipients or the categories of recipients to whom the data can be submitted and the sphere of their using;
4. the obligatory or voluntary nature of submission of the data and the consequences from a refusal of submission;
5. the right to access and to correction of the gathered data, 
(2) The data under Art. 1 shall be provided to the person whom they refer to, at the moment of its inscription in the respective register, or if the disclosure of the data is provided to a third person – not later than the moment of the disclosure for the first time. 
(3) Para 1 shall not be applied if:
1. the processing is for statistical, historical or scientific purpose and providing the data under Para 1 is impossible or requires excessive efforts;
2. the inscription or disclosure of data are explicitly stipulated by law;
3. the natural person whom the data refers has already the information under Para 1;
4. an explicit prohibition exists in this law.

Art. 21. (amend. - SG 103/05) (1) (amend. - SG 91/06) The information under Art. 19, Para 1, Items 3 – 5, Art 20, Para 1, Items 3 – 5 as well as any other information connected with the processing of the data, shall be provided after assessment of the necessity of the providing the data in order to guarantee the fair processing of the data with regard to the natural person, whom it refers to.
(2) The assessment under Para 1 shall be performed by the administrator about each concrete case.

Art. 22 (amend. - SG 103/05) (1) The administrator of personal data shall be obliged to provide access of the persons under Art. 12, Para 1 to the kept by him/her registers and to embarrass the control over the process of processing of personal data.
(2) The administrator of personal data shall be obliged to provide to the persons under Art. 12, Para 1 the required information in oral or in written, or on other information carriers.
(3) (new - SG 91/06) The presence of commercial, production or other secret protected by the Law may not be a reason for refusal of cooperation by the administrator.
(4) (prev. text of para 03 - SG 91/06) Where the information contains data, presenting classified information, the Law of Protection of the Classified Information shall be applied.
(5) (prev. text of para 04 - SG 91/06) All persons, who process personal data shall be obliged to provide assistance to the commission at exercising of its powers.

Art. 22a. (new - SG 91/06) (1) The administrators in branches and fields of activity may prepare codes of ethics for behaviour taking into consideration the specifics of their activity and the rules of the moral and the good mores.
(2) The codes of ethics may be presented before the Commission for coordination before being adopted by the administrators.

Chapter four.
PROTECTION OF THE PERSONAL DATA
Art. 23. (amend. - SG 103/05 )(1) The administrator of personal data shall undertake the necessary technical and organisational measures for the protection of the data against accidental or illegal destruction or accidental loss, unlawful access, change or dissemination, as well as against other illegal forms of processing.
(2) The administrator shall undertake special measures for protection when the processing includes transmitting of the data by electronic way.
(3) The measures under Para 1 and 2 shall be coordinated with the contemporary technological achievements and shall provide a level of protection, which is relevant to the risks, connected with the processing and to the nature of the data which shall be protected.
(4) The measures under Para 1 and 2 shall be determined by instruction of the administrator of personal data.
(5) The commission shall determine by an ordinance the minimal necessary level of technical and organisational measures, as well as the admissible type of protection. The ordinance shall be promulgated in the State Gazette.

Art. 24. (1) (amend. - SG 103/05) The administrator can process the data independently or through assignment to a person processing the data. When organisational reasons require the processing can be assigned to more than one person processing the data, including for the purpose of differentiating their concrete obligations.
(2) In the cases when the processing of the data is not carried out by the administrator he shall be obliged to appoint a person processing the data and to provide enough guarantees for their protection.
(3) (revoked – SG 103/05)
(4) (amend. - SG 103/05 ) The relations between the administrator and the person processing personal data shall be settled by a normative act, written contract or another act of the administrator, in which the volume of obligations assigned by the administrator shall be determined.
(5) (amend. - SG 103/05 ) For damaging third persons by actions or inactions of the person processing personal data, the administrator shall bear jointly liability.
(6) (amend. - SG 103/05 ) The person processing personal data as well as every person acting under the ruling of the administrator or the processing person, who has access to personal data may process the data only under instruction of the administrator, except otherwise provided by law.

Art. 25. (1) (amend. - SG 103/05) Upon achieving the task of the processing of personal data the administrator shall be obliged:
1. destroy them, or
2. transfer them, to another administrator if, notifying the commission about this, if the transfer is stipulated by a law and identity of the purposes of the processing is present.
(2) (suppl. SG 92/04; amend. - SG 103/05) Upon achieving the task of the processing of personal data the administrator shall store them only in the cases stipulated by a law.
(3) (amend. - SG 103/05) In the cases where upon achieving the task of the processing of personal data the administrator shall wants to store the processed personal data as anonymous data for historic, scientific or statistical purposes he must inform about that the Commission.
(4) The Commission for protection of the personal data can prohibit the storing for the purposes under para 3 if the administrator has not provided enough protection of the processed data as anonymous data.
(5) The decision of the commission under para 4 shall be subject to appeal before the Supreme Administrative Court. In the cases of rejection by the Supreme Administrative Court the complaint against the decision of the Commission the administrator of personal data shall be obliged to destroy them.

Chapter five.
RIGHTS OF THE NATURAL PERSONS (TITLE –AMEND. SG 103/05)
Art. 26. (1) Every individual shall have the right to access to personal data related to him.
(2) (amend. - SG 103/05) In the cases when, in exercising the right to access, disclosed to the individual can also be personal data regarding a third person the administrator shall be obliged to provide to the respective individual access to the part of them related only to him.

Art. 27. (amend. - SG 103/05; revoked – SG 91/06)

Art. 28. (amend. – SG 103/05) (1) When exercising of his/her right of access the natural person shall have right at any time to require from the administrator of personal data:
1. confirmation if the data referring to him/her are processed, information about the purpose of this processing, about the category of the data and the recipients or the categories of recipients to whom the data shall be disclosed;
2. a message to him/her in comprehensible form, containing his/her personal data, which are processed as well as any available information about their source;
3. information about the logic of each automated processing of personal data referring to him/her, at least in the cases of automated decisions under Art. 34b.
(2) (amend. – SG 94/10) The personal data administrator shall provide the information under Para 1 free of charge.
(3) In event of death of the natural person his/her rights shall be exercised by his/her heirs.

Art. 28a. (new – SG 103/05) The natural person shall have the right at any time of require from the administrator to:
1. delete, correct or block his/her personal data, processing of which does not meet the requirements of this law;
2. notify the third persons to whom his/her personal data has been disclosed about any deletion, correction or blocking performed in accordance with item 1, except in the cases where this is impossible or is connected with excessive efforts.

Art. 29. (1) (amend. - SG 103/05) The right of access under Art. 26 and the rights under Art. 28a shall be exercises by a written application to the administrator of personal data.
(2) (amend. - SG 103/05) Application can also be filed by electronic means following the procedure of the Law of the Electronic Document and the Electronic Signature.
(3) (amend. - SG 103/05) The application under Para 1 shall be filed personally by the Individual or by a person explicitly authorised by him by notary certified authorisation.
(4) (revoked – SG 103/05)

Art. 30. (1) (amend. - SG 103/05)The application under Art. 29 shall contain:
1. name, address and other data for identification of the respective individual;
2. description of the request;
3. preferred form of submission of the information under Art. 28, Para 1;
4. signature, date of filing the application and correspondence address.
(2) In filing application by an authorised person, the respective notary certified authorisation shall also be enclosed.
(3) The applications under Art. 29 shall be registered in a register by the administrator.

Art. 31. (1) (amend. - SG 103/05) The information under Art. 28, Para 1can be provided in the form of verbal or written reference or review of the data by the respective individual or by another person explicitly authorised by him.
(2) The individual can request a copy of the processed personal data on a preferred carrier or submission by electronic way, except in the cases when this is prohibited by a law.
(3) (amend. - SG 103/05)The administrator of personal data, shall be obliged to comply with the preferred by the applicant form of providing the information of Art. 28, Para 1.

Art. 32. (1) In the cases of Art. 28, Para 1 the administrator of personal data or explicitly authorised person shall consider the application of Art. 29 and shall take a decision on it within 14 days.
(2) The deadline under para 1 can be extended up to 30 days by the administrator in the cases of Art. 28, Para 1, items 1 and 2 when a longer period for gathering all requested data is objectively required, and this will create seriously the activity of the administrator.
(3) Within 14 days term the administrator shall take a decision for providing full or partial information under Art. 28, Para 1 of the applicant or shall motivate a refusal to provide it.
(4) In the cases of Art. 28a, item 1 the administrator shall take a decision and execute the respective action within 14 days period from submission of the application under Art. 29 or shall motivate the refusal to provide it.
(5) In the cases of Art. 28a, item 2 the administrator of personal data shall take a decision within 14 days period and shall immediately notify the third persons or shall make motivated refusal to perform the notification.

Art. 33. (1) (amend. - SG 103/05 ) The administrator of personal data shall notify in writing the applicant about his decision or refusal according to art. 32, para 3.
(2) The notification under para 1 shall be personal against signature or by return mail.
(3) (new – SG 103/05) Lack of notification under Para 1 shall be considered as a refusal.

Art. 34. (1) (amend. - SG 103/05) The administrator of personal data shall refuse access to personal data when the data do not exist or providing is forbidden by a law.
(2) (revoked – SG 103/05) 
(3) (new – SG 92/04; amend. and suppl. - SG 91/06) The administrator shall refuse full or partial conceding of data to the person the data refers to would occur danger for the defence or the national security or for the preservation of the classified information and that is provided by a special law.

Art. 34a (new – SG 103/05) (1) The natural person whom the data refers to shall have the rights to:
1. object before the administrator against the processing of his/her personal data if legal ground for this exists; where the objection is grounded, the personal data of the respective natural person may not be processed any longer;
2. objects against the processing of his/her personal data for the purposes of the direct marketing;
3. be notified before his/her personal data is discloses for the first time to third persons or used on their behalf for the purposes of item 2 and opportunity to object against such disclosure of usage shall be provided to him/her.
(2) The administrator shall notify the natural person about his/her rights under Para 1, items 2 and 3.

Art. 34b. (new – SG 103/05) (1) The decision of the administrator shall be inadmissible, if:
1. legal or other significant consequences for the natural person exist, and 
2. is grounded only on automated processing of personal data, designed to assess personal characteristics of the natural person.
(2) Para 1 shall not be applied, if the decision is:
1. taken during a conclusion or execution of a contract, under the condition that the submitted by the respective application for concluding or execution of the contract has been satisfied or other appropriate measures exist, guarantying his/legal interests; 
2. settled by a law, providing measures for protection of the legal interests of the person;
(3) The natural person shall have the right to require from the administrator to revise the decision adopted in offence of Para 1.

Chapter six.
SUBMISSION OF PERSONAL DATA TO THIRD PERSONS
Art. 35. (amend. - SG 103/05; revoked – SG 91/06)

Art. 36. (amend. - SG 103/05, shall be applied till the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force) (1) Providing personal data by the administrator to foreign natural or legal persons or to foreign state bodies shall be admitted with permission of the Commission for Protection of the Personal Data, if the legislation of the recipient country guarantee better or equal to the provided by this law protection of the data.
(2) During the transfer of personal data in the cases under Para 1, the requirements of this law shall be observed.

Art. 36a. (new – SG 103/05 in force from the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force) (1) Providing of personal data to a Member State of the European Union as well as to another member state of the European Economic Space shall be performed free and observing the requirements of this law.
(2) Providing personal data to a third country shall be admitted only it provides an adequate level of protection of the personal data on its territory.
(3) The assessment of the adequacy of the level of protection of the personal data in a third country shall be performed by the Commission for Protection of the Personal Data, taking in view all circumstances connected with the actions or the set of activities of providing the data, including the nature of the data, purpose and duration of their processing, their legal regulation and measures of protection provided in the third country.
(4) (amend. - SG 91/06) The Commission for Protection of the Personal Data shall not perform assessment under Para 3 in the cases where performance of a Decision of the European Commission is necessary ruling that:
1. the third country where the personal data is provided provides adequate level of protection;
2. certain standard contractual clauses provide adequate level of protection.
(5) (amend. - SG 91/06) In the cases of Para 4, Item 2 the administrator shall use standard contractual clauses when providing data in third country.
(6) Except the cases of Para 2 and 4, the administrator may provide personal data in a third country, if:
1. the person whom the data refers to has given explicit consent for this;
2. (amend. - SG 91/06) providing is needed for performance of obligations of a contract between the natural person and the administrator as well as for actions preceding conclusion of a contract and undertaken by request of the natural person;
3. (amend. - SG 91/06) providing is necessary for conclusion and performance of obligations of a contract concluded in interest of the natural person between the administrator and another person;
4. providing is necessary or is required by law due to a significant public interest or for exercising and the defence of rights under a court procedure;
5. providing is necessary to protect the live and the health of the person, whom the data refers to;
6. (amend. - SG 91/06) source of the data is a public register the access to which is provided according to conditions and order determined by a law.
(7) Providing of personal data in third countries is admissible in all cases if it is performed for the purposes of journalistic activity, the literature or artistic expression, as far as this processing does not injure the right of private life of the person, whom the data refers to.

Art. 36b. (new – SG 103/05 in force from the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force) (1) Besides the cases of Art. 36a, providing of personal data in a third country shall be executed after a permission of the Commission for Protection of the Personal Data, under the condition that the administrator providing the data and the administrator accepting the data, present enough guarantees for its protection.
(2) (suppl. - SG 91/06) The Commission shall notify the European Commission and the competent bodies of the other Member States about the permissions granted under Para 1 as well as about the refusals to provide such permissions.

Art. 37. (revoked – SG 103/05)

Chapter seven.
APPEALING ACTIVITIES OF THE ADMINISTRATOR OR PERSONAL DATA
Art. 38. (1) (amend. - SG 103/05; amend. - SG 91/06) In event of violation of the rights under this law, every natural person shall have the rights to approach the Commission for Protection of the Personal Data within a period of one year from learning about the violation, but not later than five year from its occurrence.
(2) (amend. - SG 103/05) The Commission for protection of the personal data shall take decision within 30 days from the approaching and can give obligatory prescriptions and to determine a deadline for rectification of the offence or to impose administrative penalty.
(3) (revoked – SG 103/05)
(4) The Commission for protection of the personal data shall send a copy of its decision to the individual.
(5) (new - SG 91/06) In the cases referred to in Para 1 where personal data for the needs of the Defence, the National Security and the Public Order as well as for the needs of the Penal Proceedings is processed, the Decision of the Commission shall contain only findings regarding the lawfulness of the processing.
(6) (amend. - SG 103/05; prev. text of para 05 - SG 91/06) The decision of the commission under para 2 shall be subject to appeal before the Supreme Administrative Court within 14 days from its receipt.

Art. 39. (1) (amend. - SG 103/05; amend. - SG 30/06, in force from 12.07.2006; amend. - SG 91/06) In the cases of injure of his/her rights under this law, every natural person shall have the right to appeal actions and acts of the administrator following the court procedure the before the respective administrative court or before the Supreme Administrative Court under the general rules of jurisdiction.
(2) (amend. - SG 103/05) Within the procedure under Para 1 the natural person may demand compensation for the suffered by him/her damages due to the unlawful processing of personal data by the administrator.
(3) (new - SG 103/05)The natural person mat not approach the court if there are pending proceedings before the Commission for the same violation or its decision concerning the same violation has been appealed and there is no enacted court decision. Upon a request of the natural person, the Commission shall certify the lack of pending procedure before it for the same dispute.
(4) (prev. text of Para 3 – amend., SG 103/05; revoked – SG 91/06)
(5) (prev. text of Para 4 – amend., SG 103/05; amend. - SG 30/06, in force from 12.07.2006; revoked – SG 91/06)

Art. 40. (revoked – SG 103/05)

Art. 41. (revoked – SG 103/05)

Chapter eight.
ADMINISTRATIVE PENAL PROVISIONS
Art. 42. (amend. - SG 103/05) (1) For offences under Art. 2, Para 2 and 4 the administrator of personal data shall be punished by a fine or property sanction of 10 000 to 100 000 BGN.
(2) For offences under Art. 5 the administrator shall be punished by a fine or property sanction of 10 000 to 100 000 BGN.
(3) (amend. - SG 91/06) For offences under Art. 20. Para 1, the administrator shall be punished by a fine or property sanction of from 2 000 to 20 000 BGN.
(4) An administrator who does not fulfil his obligation for registration under Art. 17, Para 1 shall be punished by a fine or property sanction of 100 to 3000 BGN.
(5) (new - SG 91/06) Any administrator who commences processing of personal data in violation of Art. 17b, Para 4 shall be punished by a fine or proprietary sanction in amount from 2000 to 20 000 BGN.
(6) (new - SG 91/06) Any administrator who does not perform his obligations under Art. 22, Para 1 and 2 shall be punished by a fine or proprietary sanction in amount from 1000 to 20 000 BGN.
(7) (prev. text of para 05 - SG 91/06) An administrator who does not pronounce on the application of Art. 29 within the term, shall be punished by a fine or property sanction of 1000 to 20 000 BGN, if is not subject to a more severe punishment.
(8) (prev. text of para 06 - SG 91/06) For a refusal to assist the commission in connection with its controlling powers, the persons shall be punished by a fine or a property sanction from 1000 to 10 000 BGN.
(9) (prev. text of para 07 - SG 91/06) For other offences of this law the guilty persons shall be punished by a fine or property sanction of 500 to 1000 BGN.

Art. 42a. (new – SG 103/05) Where the offences of this law are repeatedly perpetrated, a fine or property sanction in doubled amount of the initially imposed shall be imposed.

Art. 43. (1) (amend. - SG 103/05) The acts for establishing the administrative offences shall be drawn up by a member of the Commission for protection of the personal data or by officials authorised by the commission.
(2) (suppl. - SG 103/05; amend. - SG 91/06) The penal decrees shall be issued by the chairman of the Commission for protection of the personal data.
(3) (new - SG 91/06) Proprietary sanctions and fines imposed by punitive decrees in force shall be collected under the order of the Tax-Insurance Procedure Code.
(4) (prev. text of para 03 - SG 91/06) The establishing of the offences, the issuance, the appeal and the fulfilment of the penal decrees shall be carried out by the order of the Law for the administrative offences and penalties.

Additional provisions

§ 1. In the context of this law:
1. (amend. - SG 103/05; amend. - SG 91/06) "Processing of personal data" is every action or a set o factions which may be performed with regard to the personal data by automated or other means, such as gathering, entry, organising, storing, adaptation or change, recovery, consulting, using, combining, freezing, disclosing by handing, disseminating, updating or combining, blocking or destructing.
2. (amend. - SG 103/05) "Register of personal data" shall be each structured set of personal data, accessible by e definite criteria, centralised or de-centralized or distributed per functional or geographic principle. 
3. (amend. - SG 103/05) "Person processing personal data" is an individual or a corporate body or a body of state power or a body of local government, which is processing personal data on behalf of the administrator of personal data.
4. (revoked. - SG 103/05)
5. "Submission of personal data" are activities on the entire or partial transfer of personal data from one administrator to another or to a third person on the territory of the country or out of it.
6. (amend. - SG 103/05) "Anonymous data" is data, brought in a form which does not allow to refer it to the relevant natural person, whom it refers to.
7. "Freezing" is the storing of personal data with temporary suspension of their processing.
8. (revoked – SG 103/05)
9. "Repeated" is the offence committed within one year from the enforcement of the penal decree which imposes a punishment for the same type of offence.
10. (new, SG 70/04) "Human genome" is the combination of all genes in a single (diploid) complex of chromosomes of a person.
11. (new – SG 103/05) "Third person" is a natural or a legal person, body of state power or a body of local government, different than the natural person whom the data refers to, than the administrator of personal data, than the person processing personal data and than the persons who under the direct ruling of the administrator or of the person processing the data have the right to process personal data.
12. (new – SG 103/05) "Recipient" shall be a natural or a legal person, body of state power or a body of local government, to which the personal data is disclosed, not depending if they are a third person or not The bodies which may obtain data within the frames of a concrete research shall not be considered recipients.
13. (new – SG 103/05; suppl. - SG 91/06) "Consent of the natural person" shall be each free expressed, concrete and informed act of expression of will, by which the natural person whom the data refers to agrees the data shall be processed.
14. (new – SG 103/05, in force from the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force) "Third country" shall be each country, which is not a Member State and is not a party to the Agreement on the European Economic Area.
15. (new – SG 103/05) "Direct marketing" shall be offering of goods and services to natural persons by mail, telephone or in other direct manner, as well as questioning with the purpose of research with regard to the offered goods and services.
16. (new - SG 91/06) “Specific indices” means indices related to the physical, physiological, genetic, psychical, psychological, economical, cultural, social and other identity of the person.

§ 1a. (new - SG 91/06) This Law shall implement the provisions of Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data.

Transitional and concluding provisions

§ 2. (1) Within one month from the enactment of this law the Council of Ministers shall propose to the National Assembly the members of the Commission for protection of the personal data.
(2) Within 14 days from the presentation of the proposal under para 1 the National Assembly shall elect the members of the Commission for protection of the personal data.
(3) Within 3 months from its election the Commission for protection of the personal data shall adopt and promulgate in the State Gazette the regulations under art. 9, para 2.
(4) Within one month from the enactment of the decision of the National Assembly under para 2 the Council of Ministers shall provide the necessary property and financial resources for the commencement of the work of the commission.

§ 3. (1) Within 6 months from the enactment of the regulations under art. 9, para 2 the persons who, by the moment of enactment of the law, maintain registers of personal data, shall bring them in compliance with the requirements of the law and shall notify the commission about that.
(2) The commission shall carry out preliminary inspections, shall register or refuse to register as administrators persons who maintain registers by the moment of enactment of the law, as well as the registers kept by them within 3 months from the receipt of the application under para 1.
(3) The decisions of the commission for refusal of registration shall be subject to appeal before the Supreme Administrative Court within 14 days.
(4) Upon the enactment of the decision of the commission for refusal of registration or of the decision of the Supreme Administrative Court which confirms the refusal of the commission the person who unlawfully keeps a register shall be obliged to destroy personal data contained in his register or, upon the consent of the commission, to transfer them to another administrator who has registered his register and processes personal data for the same purposes.
(5) The commission shall exercise control over the fulfilment of the obligation under para 4.
(6) Within 3 months from the registration the administrator under art. 3, para 1 shall be obliged to publish in the bulletin of the Commission for protection of the personal data the information under art. 22, para 1.

§ 4. The following amendments are introduced to the Law for access to public information (SG 55/2000):
1. In art. 2, para 3 the words "personal information" are replaced by "personal data".
2. In § 1, item 2 is amended as follows:
"2. "Personal data" are information for an individual disclosing his physical, psychological, mental, marital, economic, cultural or public identity."

§ 5. The law shall enter into force on January 1, 2000.

The law was adopted by the 39th National Assembly on December 21, 2001 and was affixed with the official seal of the National Assembly.

Transitional and concluding provisions
TO THE LAW OF AMENDMENT AND SUPPLEMENTATION OF THE ALW FOR PROTECTION OF THE PERSONAL DATA
(PROM. – SG 103/05; AMEND. - SG 91/06)

§ 50. The provision of § 38 regarding Art. 36, shall be applied till the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force

§ 51. (amend. - SG 91/06) The provisions of § 1 regarding Art. 1, Para 4, item 3, § 48, item 5 regarding item 14 of the additional provision shall enter in force from the Pre-accession Agreement of the Republic Bulgaria with the European Union enters in force.

§ 52. Within three months term from the Law of the Commission for Protection of the Personal Data enters in force, the Ethics Code under Art. 10, Para 4 and the ordinance of Art. 23, Para 5 shall be adopted.

Transitional and concluding provisions
TO THE ADMINISTRATIVE PROCEDURE CODE
(PROM. – SG 30/06, IN FORCE FROM 12.07.2006)

§ 142. The code shall enter into force three months after its promulgation in State Gazette, with the exception of:
1. division three, § 2, item 1 and § 2, item 2 – with regards to the repeal of chapter third, section II "Appeal by court order", § 9, item 1 and 2, § 15 and § 44, item 1 and 2, § 51, item 1, § 53, item 1, § 61, item 1, § 66, item 3, § 76, items 1 – 3, § 78, § 79, § 83, item 1, § 84, item 1 and 2, § 89, items 1 - 4§ 101, item 1, § 102, item 1, § 107, § 117, items 1 and 2, § 125, § 128, items 1 and 2, § 132, item 2 and § 136, item 1, as well as § 34, § 35, item 2, § 43, item 2, § 62, item 1, § 66, items 2 and 4, § 97, item 2 and § 125, item 1 – with regard to the replacement of the word "the regional" with the "administrative" and the replacement of the word "the Sofia City Court" with "the Administrative court - Sofia", which shall enter into force from the 1st of May 2007;
2. paragraph 120, which shall enter into force from the 1st of January 2007;
3. paragraph 3, which shall enter into force from the day of the promulgation of the code in State Gazette.

Transitional and concluding provisions
TO THE LAW ON AMENDMENT AND SUPPLEMENTATION OF THE LAW FOR PROTECTION OF THE PERSONAL DATA
(PROM. - SG 91/06)

§ 31. The provision of Paragraph 6 regarding Art. 6, Para 2 shall enter into force from 1 January 2007.

§ 32. The Commission for Protection of the Personal Data shall adopt the instruction referred to in Art. 12, Para 9 within a term of two months from the entrance into force of this Law.

§ 33. Within a term of three months from the entrance into force of this Law the administrators subject to registration shall submit an application for registration.

Transitional and concluding provisions
TO THE LAW OF THE NATIONAL ARCHIVE FUND
(PROM. - 57/07, IN FORCE FROM 13.07.2007)

§ 23. The Law shall enter into force from the day of its promulgation in the State Gazette.

Transitional and concluding provisions
TO THE LAW ON AMENDMENT AND SUPPLEMENTATION OF THE LAW ON PREVENTION AND DISCLOSURE OF CONFLICTS OF INTERESTS
(PROM. - SG 97/10, IN FORCE FROM 10.12.2010)

§ 61. The Law shall enter into force from the day of its promulgation in the State Gazette except:
1. paragraphs 11 regarding Art. 22a – 22e, which shall enter into force from 1 January 2011;
2. paragraphs 7, 8, 9 § 11 regarding Art. 22f – 22i and § 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22 and 23, which shall enter into force from 1 April 2011.