• Strategies and Policy
  • Business Environment
  • Small and Medium-sized Enterprises
  • Industry 4.0
  • Consumer Protection
• A Guide for SMEs
  • Information
  • Starting up a business
  • Business operations
    • Human resources
    • Accounting and reporting
    • Financing
    • Commerce Activities
    • Personal data protection
    • Public procurement
    • Research and development (R&D)
    • Construction
  • Changes in the structure
  • Termination of the operations
• Statistics and Analysis
  • Foreign Trade Statistics
  • Macrobulletin
• Licenses and Concessions
  • Industrial Licenses
  • Export Controls
• Useful Contacts for Users and Producers
  • Internal Market Information System
  • Single Point of Contact for Service Providers
• Foreign Economic and Trade Policy
  • General Trade Policy
  • Bilateral Foreign Economic Relations
  • Commercial Services Abroad
  • Business Support
• Industrial cooperation

Updated last 26.03.2021

When it is possible to process personal data?

For the personal data processing to be lawful, it should be performed at one of the listed in article 6 of the Regulation conditions. Within the progress of the commercial activity the most common grounds for processing are: for the purpose of the controller’s legitimate interests, based on a contract and based on a legal obligation. The conditions, under which the personal data processing could be performed based on the consent of the data subject, is also important to be known.

Personal data may be processed, if necessary, for the purposes of the legitimate interests of the controller (for the definition of controller's role, please see or of a third party. In order for this to happen, the key rights and freedom of the natural persons, whose data is processed, must not prevail upon the legitimate interest of the controller. Often, the grounds for the legitimate interest may apply, when achieving the marketing or video surveillance objectives.

An example of the application of these grounds may be the legitimate interest of the employer to control the performance of the tasks of his employees. If the employer carries out such control through the switched-on location of a mobile device, which the employees are obliged to carry on with them, the employer will not violate the rights of his employees, if there is no other possible way to carry out such control. If, however, the employer is capable of controlling his employees by other means (if they move within confined areas) then, if the employer monitors them through mobile devices with activated location function, this would be a breach of their rights and legal interests. Тhe reason for this is that there are a number of other methods to control the performance of the tasks and these methods do not breach to such an extent the personal space of the employees, as the activated location function.

Important to know

The statement, that the data processing is performed at the conditions of legitimate interest of the controller, does not makes it automatically legal and lawful. A detailed analysis on a case-by-case basis is required to determine if and to what extent controller’s interests limit the general rights and freedom of the data subject and whether or not and to what extent such a limitation is justified.

When consent forms grounds for personal data processing?

Consent only applies in cases when the data subject is in a situation, when he can make a decision of whether or not he wants his data to be processed for specific and clearly defined purposes. Such consent must be given freely, to be informed, specific, express and unambiguous. The data subject must be able to withdraw such consent at any time, without any negative consequences for him. No consent may be requested from a child, aged below 13 years in relation to direct offering of services of the information society. The Bulgarian Personal Data Protection Act stipulates that the processing of data of a child of under 14 years of age based on consent is lawful only if the consent is granted by the parent, exercising parental rights, or by the guardian of the data subject.

For more information
	For more information, please visit the websites of the: Commission for Personal Data Protection European Commission, section „Personal data protection“