Personal data requests and consents under the GDPR in Bulgaria
In Bulgaria personal data are protected by the General Data Protection Regulation, which applies directly, and by the Personal Data Protection Act (Закон за защита на личните данни); the supervisory authority is the Commission for Personal Data Protection (КЗЛД). Anyone can ask an organisation that processes their data for access to them or for their erasure, and can object to the processing. The controller answers without undue delay and at the latest within one month of receiving the request; for complex or numerous requests the period can be extended by two further months, provided the controller says so within the first month. The answer is free unless a request is manifestly unfounded or excessive.
The right to erasure has limits: data an organisation must keep by law, or needs in order to defend legal claims, stay. An objection to direct marketing has none, and once it is made the data are no longer processed for that purpose. The documents are in Bulgarian, for a Bulgarian organisation or the Bulgarian commission, and each page describes its document in English. The subject access request, the request for erasure and the objection to direct marketing go straight to the controller, whether an employer, a bank, a shop or an app. If no answer comes in time, or the request is refused, the next step is a complaint to the commission with copies of the correspondence.
Consent is only one of the grounds for processing, and it counts only if freely given, specific, informed and unambiguous; silence, a pre-ticked box or inactivity is not consent, and it must be possible to withdraw it at any time. The consent to the processing of personal data lists each purpose separately, and the consent to being photographed sets out where and for how long the pictures or footage will be used, with a parent signing for a child. Each template is filled in online and downloaded as a finished PDF, or blank.
The documents
6 forms available to fill out or download.
Consent to being photographed and to the use of the image
Needed by photographers, agencies, schools and event organisers — the image of an identifiable person is personal data, and using it for advertising or publication requires consent. The declaration sets out where and for how long the material will be used, whether there is a fee, and whether the person will be named. For a child it is signed by a parent.
Consent to the processing of personal data
Consent is only one of the grounds for processing, and the most fragile one: it has to be specific, informed and capable of being withdrawn, and silence or a pre-ticked box is not consent. So this declaration lists the purposes separately and states the right to withdraw expressly. If you process data under a contract or under a statutory duty, you do not need consent and should not ask for it.
Request for erasure of personal data
The right to be forgotten under Article 17 of the General Data Protection Regulation. It is not unconditional: data the organisation keeps by law, for accounting, or to defend a legal claim stay. So the request names exactly which data and on what ground, and asks for a written answer — including when the answer is a refusal, so that there is something to appeal against.
Complaint to the Commission for Personal Data Protection
The step to take when a controller has not answered your request or has refused it without good reason. The order is the same as in consumer disputes: first a request to the organisation, then a complaint to the commission with a copy of the correspondence attached. A complaint with no prior request is usually sent back, because there is no refusal to examine.
Subject access request
The right under Article 15 of the General Data Protection Regulation: to find out what data an organisation holds about you, where it got them, who it gives them to and how long it keeps them. The request is free and goes straight to the controller, not to the regulator. Word it specifically — a blanket request for everything usually comes back with the least that will do.
Objection to processing for direct marketing
Marketing calls, messages and letters stop on an objection under Article 21 of the General Data Protection Regulation. Unlike the other rights, there is no balancing here and no exceptions: on an objection to direct marketing, processing for that purpose ends. The document lists the channels separately, because unsubscribing from the newsletter does not stop the phone calls.