Personal data breach: when and how to notify the Bulgarian data protection authority

The General Data Protection Regulation (GDPR) requires every controller of personal data to act quickly after a breach. The deadlines are short, and a missed notification is a separate infringement that can lead to fines.

What a personal data breach is

A breach is any incident that leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Examples:

• a stolen customer database of an online shop;
• an email containing personal data sent to the wrong recipient;
• a lost laptop without disk encryption;
• a ransomware attack in which the data is encrypted and unavailable.

Notifying the authority

The controller notifies the Bulgarian Commission for Personal Data Protection (КЗЛД) without undue delay and, where feasible, within 72 hours of becoming aware of the breach (Article 33 GDPR). Notification is not required only when the breach is unlikely to result in a risk to the rights and freedoms of the people affected. A notification made after 72 hours must state the reasons for the delay.

A processor, for example an accounting firm or a hosting provider, notifies the controller without undue delay after becoming aware of the breach.

What the notification contains

• the nature of the breach, the categories and approximate number of people and records concerned;
• the name and contact details of the data protection officer or another contact point;
• the likely consequences of the breach;
• the measures taken or proposed to address the breach and limit its consequences.

The information may be provided in stages if it is not all available at once. The Commission offers an optional notification form on its website (cpdp.bg). The notification is submitted by the controller or by an expressly authorised person in one of the following ways:

• in person at the Commission's registry: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia;
• by post to the same address;
• by email to kzld@cpdp.bg, signed with a qualified electronic signature;
• through the Secure Electronic Delivery System.

Informing the people affected

When the breach is likely to result in a high risk to the people affected, the controller informs them without undue delay (Article 34 GDPR). The message uses plain language and explains what happened and what people can do, for example change a password or watch out for phishing emails. This is not required if the data was encrypted and the key was not compromised.

Internal breach register

Every breach is documented, including those not notified to the Commission: the facts, the consequences and the measures taken (Article 33(5) GDPR). During an inspection, the register shows how the company responded.

First steps after a breach

1. Contain the incident: change passwords and disconnect the affected systems.
2. Establish what data is affected and how many people.
3. Record the moment the company became aware of the breach. The 72-hour deadline runs from then.
4. Assess the risk to the people affected and prepare the notification.

Sources: Regulation (EU) 2016/679, Articles 33 and 34; КЗЛД guidance on action after a personal data breach; EDPB Guidelines 9/2022.