Cyber Law at Bulgaria
Bulgaria has established a comprehensive legal and institutional framework to address cybercrime, data protection, and cybersecurity, aligning with European Union directives and international standards.
Cybercrime Legislation
Bulgaria's Criminal Code criminalizes various cybercrimes, including unauthorized access to computer systems, data interference, and cyber fraud. Key provisions include:
Article 319a: Penalizes unauthorized access to a computer system with imprisonment of up to six years and fines up to BGN 3,000.
Article 319b: Addresses unauthorized modification or deletion of computer data, with penalties up to six years in prison and fines up to BGN 10,000.
Article 212a: Criminalizes computer-related fraud, including the unauthorized use of electronic signatures, punishable by imprisonment from one to six years and fines up to BGN 6,000.
These provisions align with the Council of Europe's Budapest Convention on Cybercrime, which Bulgaria ratified in 2005
Data Protection
Bulgaria's data protection framework is primarily governed by the Personal Data Protection Act (PDPA), which implements the EU General Data Protection Regulation (GDPR). Key aspects include:
Data Controller and Processor Responsibilities: Organizations must ensure that any processors they engage comply with data protection requirements.
Data Breach Notification: In the event of a personal data breach, electronic communications providers must notify the Bulgarian Personal Data Protection Commission within 24 hours of becoming aware of the breach
Sanctions: Violations can result in administrative fines up to EUR 10 million or 2% of the total worldwide annual turnover for legal entities, and up to EUR 20 million or 4% for more serious violations.
Cybersecurity
Bulgaria's Cybersecurity Act, adopted in 2018, establishes a national framework for cybersecurity, including:
Incident Reporting: Entities must notify competent authorities within two hours of becoming aware of a cybersecurity incident.
Sanctions: Non-compliance can result in fines for individuals and monetary sanctions for legal entities ranging from BGN 1,000 to 25,000
The Act is being updated to align with the EU's NIS2 Directive, which introduces expanded requirements for cybersecurity across member states. The proposed amendments will broaden the scope of regulated entities and enhance risk management obligations
Institutional Oversight
The Ministry of Transport, Information Technologies and Communications oversees the implementation of cybersecurity measures in Bulgaria. The National Cybersecurity Competent Authority within the Ministry is responsible for coordinating national efforts to protect critical infrastructure and digital services
These legal and institutional frameworks demonstrate Bulgaria's commitment to enhancing cybersecurity, protecting personal data, and combating cybercrime in alignment with EU directives and international standards.
RELATED Blog
0 comments