Government & Public Services Compliance in Bulgaria

The market for identity services to the Bulgarian public sector is open but tightly structured. Private firms can take part as qualified trust service providers, as electronic identity administrators and centres registered with the Ministry of Interior, or as operators of a notified electronic identification scheme. Every means used for public services must also connect to the state's central electronic authentication system.

Policy and the central e-government systems belong to the Ministry of Innovation and Digital Transformation, created in May 2026 by merging the Ministry of e-Government with the Ministry of Innovation and Growth. The Ministry of Interior issues identity documents and is the electronic identification authority. The Communications Regulation Commission supervises trust services, and the Commission for Personal Data Protection supervises data protection.

The biggest obstacle for a new entrant is timing. Issuing identity cards with the national eID certificate under the 2016 Electronic Identification Act depends on technical conditions not yet declared in place, and the wallet law is still a draft, so products must support several interim means at once.

1. Who regulates this sector

The Ministry of Innovation and Digital Transformation's Rules of Organisation (adopted by Council of Ministers Decree No. 104 of 18 August 2026, State Gazette No. 76 of 2026, in force 1 September 2026) place e-government, electronic identification and trust services policy with its minister, by reference to the Electronic Governance Act (Art. 4). The consolidated statutory texts cited in this guide still name the "Minister of e-Government". Bulgaria is a unitary state, so identity rules are national; municipalities apply the same Electronic Governance Act when they provide electronic services.

2. Licensing and authorisation

Public bodies need no licence to run online services, but the private firms that supply identity to them do. Three routes exist:

eID administrators and centres

Under the Electronic Identification Act (Arts. 8 to 17), firms that take eID applications or run automated eID checks must be entered in the Ministry of Interior's public register. They need qualified staff, tested equipment, internal security procedures and financial cover or insurance. The Ministry decides within 14 days of a complete application; registration is indefinite and cannot be transferred.

Qualified trust service providers

The Electronic Document and Electronic Trust Services Act (Art. 32) makes the Communications Regulation Commission the supervisory body that grants qualified status under eIDAS Articles 20 and 21 and keeps the trust list. Qualified certificates are what citizens use to sign online applications.

Notified eID schemes

A scheme notified to the European Commission must be accepted by Bulgarian online public services. The Commission's list of 20 December 2024 shows one Bulgarian scheme, "Evrotrust eID", notified by the Ministry of e-Government on 5 July 2023 at assurance levels substantial and high.

Any means of identification used for public services must be interoperable with, and integrated into, the state electronic authentication system (Electronic Governance Act, Art. 5(3)). Acting as an eID administrator or centre without registration carries a fine or property sanction of BGN 200,000 (Electronic Identification Act, Art. 44), doubled for a repeat offence. A licensing regime for wallet providers is in the draft wallet law and is not yet in force.

3. Identity framework (AML rules do not apply)

Public bodies are not obliged entities under the Measures Against Money Laundering Act (Закон за мерките срещу изпирането на пари, State Gazette No. 27 of 2018, consolidated to State Gazette No. 51 of 2026). Its Article 4 list covers financial institutions, gambling operators, professionals and others; the Bulgarian National Bank appears only when it deals with the general public. The Act still reaches the public sector in two ways: the Financial Intelligence Directorate may request information from state and municipal bodies, which may not refuse it (Art. 74(4)), and obliged firms identifying customers remotely may rely on eIDAS means and other legally recognised electronic identification (Art. 53(8)).

The identity framework that governs public services is set by the Electronic Governance Act (Закон за електронното управление, State Gazette No. 46 of 2007, consolidated to State Gazette No. 17 of 2026):

• When identification is required. Duties to identify arise only where a law requires identification for the service (Art. 5(1)).
• Accepted means. Providers must let users identify with: the national scheme under the Electronic Identification Act; means under schemes notified under eIDAS Article 9; high-assurance means issued under a national electronic identification trust service on the Communications Regulation Commission's trust list; or other means set by ordinance (Art. 5(2)).
• Assurance levels. Each provider, in agreement with the minister responsible for e-government, names the means and the eIDAS Article 8 assurance level for each service and publishes them. A service with no stated level is treated as "low" (Art. 5(4)). Means are also entered in the Administrative Register (Art. 5(5)).
• Once-only data. Public bodies may not ask people to provide or prove data already collected; they must obtain it from the primary data administrator (Art. 2(1)).

The Act also binds persons exercising public functions and organisations providing public services, unless another law provides otherwise (Art. 1(2)).

4. Identity verification and onboarding

Accepted documents

The Bulgarian Identity Documents Act (Закон за българските лични документи, State Gazette No. 93 of 1998) lists the documents that prove a citizen's identity: the identity card, the passport family (including diplomatic, service, seaman's passports and the military identity card) and the driving licence (Art. 13). Article 14 covers foreigners' documents. The identity card chip holds the holder's data, facial image and fingerprints in a protected segment following ICAO Doc 9303 (Art. 20a(4)). The Act also lets the card carry an eID certificate unless the citizen opts out (Arts. 18(7) and 23(4)), but the 2023 amending act (State Gazette No. 65 of 2023, §25(2)) defers issuing eID-capable documents until the technical and organisational conditions exist. Identity cards that do not meet Regulation (EU) 2019/1157 remain valid until 2 August 2031 at the latest (§24(2)).

The Ministry of Interior runs a free online validity check for Bulgarian identity and residence documents, searched by document type, number and date of birth.

The national eID scheme

Under the Electronic Identification Act, the Minister of Interior is the electronic identification authority (Art. 7). Any natural person aged 14 or over may hold an eID certificate (Art. 6). The certificate is issued only after the person appears in person with a valid identity document; minors also need a parent or guardian present (Art. 20(2) and (3)). It is valid for five years, may be renewed online before it expires, and is suspended or revoked on request, on compromise, or where it was issued on false data (Arts. 20 to 22). The national scheme counts as "in production" from the date the first certificate is issued (Ordinance on the General Requirements for Information Systems, Registers and Electronic Administrative Services, Supplementary Provisions, §1(20)).

Interim means

Until then, and for set periods after it, the Ordinance (§5) allows identification by reading the unique identifier (the personal number) from a qualified electronic signature certificate, and by the personal identification codes of the National Revenue Agency and the National Social Security Institute and the access code of the National Health Insurance Fund, once integrated with the authentication system. The Ministry's electronic identification page lists these as the other means currently recognised. Applications signed online may use an advanced electronic signature after identification under the Electronic Identification Act (Ordinance, Art. 21).

5. Digital channels: what's different

Bottom line: the duty to identify is channel-neutral, but online it is met only with listed electronic means at a declared assurance level, while the main ways of getting a state credential (the eID certificate, a first identity card) still require a visit in person.

Assurance levels decide the product

Because each service declares its own level under Article 5(4) of the Electronic Governance Act, a provider of identity means must map its credential to the eIDAS levels low, substantial and high. Access to personal records held in central registers through the e-government system requires a high-level means (Ordinance, Art. 11(7)).

Remote renewal is conditional

Article 18a of the Identity Documents Act allows an online application for a new document only where the previous document was applied for in person within 59 months, the applicant holds a qualified signature or an eID certificate, and fingerprints are already on file. The application is signed with a qualified signature, or submitted after identification under the Electronic Identification Act.

Cross-border users

Bulgarian public services must recognise eID means issued under schemes notified by other Member States, through the Bulgarian eIDAS node within the state authentication system. Regulation (EU) 2024/1183 adds wallets: where a public online service requires electronic identification, it must also accept European Digital Identity Wallets (Art. 5f(1) of Regulation (EU) No 910/2014 as amended).

[Draft, consultation closed 9 Apr 2026] The national wallet law (Закон за Европейския портфейл за цифрова самоличност) would create a free state wallet for individuals, oblige certain relying parties and e-service providers to accept wallets, and offer free qualified signatures for non-professional use.

6. Data protection and biometrics

The GDPR (Regulation (EU) 2016/679) applies directly, supplemented by the Personal Data Protection Act (Закон за защита на личните данни, consolidated to State Gazette No. 69 of 2026). Three points bite on identity capture:

• Copies of identity documents. A controller or processor may copy an identity card, driving licence or residence document only where a law provides for it (Personal Data Protection Act, Art. 25g). A remote flow that stores an image of the document therefore needs a statutory basis, not consent alone.
• Biometrics. Biometric data used to identify a person uniquely is special category data under GDPR Article 9. For identity documents the legal basis is the Identity Documents Act itself, which sets the capture of facial image and fingerprints; fingerprints are not taken from children under 12 (Art. 17(4)).
• Retention and logs. eID administrators keep application records for 20 years (Electronic Identification Act, Art. 8(4)). Register operations are logged with a qualified time stamp and made available to the data subject (Ordinance, Art. 11(5) and (7)).

Sectoral electronic identifiers, derived cryptographically from the main identifier and impossible to reverse, limit linkage across sectors; the sectors are set by the Council of Ministers with the agreement of the Commission for Personal Data Protection (Electronic Identification Act, Art. 4).

7. Sector-specific obligations

Publishing means and levels

Every administrative body must publish, for each electronic service, the identification means accepted and the assurance level, and record the means in the Administrative Register (Electronic Governance Act, Art. 5(4) and (5)). Applications are checked for identity at once on receipt where a law requires identification (Ordinance, Art. 20(1)).

Electronic authorisation and proxies

Representatives may apply on someone's behalf. Where the authorisation is registered electronically under the Electronic Identification Act, no separate power of attorney is needed (Ordinance, Art. 20(8) and (9)).

Cybersecurity

The Cybersecurity Act, amended by State Gazette No. 17 of 2026 to implement the NIS 2 Directive, applies to all administrative bodies and, regardless of size, to trust service providers, and to persons exercising public functions and public service organisations when they deliver administrative services electronically (Art. 4).

8. Risk indicators and red flags

Identity abuse indicators in public e-services

• Compromised credential: signs that an eID certificate or its keys are misused, a ground for immediate revocation (EIA, Art. 22(2)).
• Certificate on false data: an eID certificate later found to rest on untrue information.
• Stale identity data: name or personal-number changes not reflected in the credential, which also triggers revocation.
• Invalid documents: an identity card declared invalid (for example, lost or forged), which also ends any eID certificate it carries (Identity Documents Act, Art. 32(3)).
• Unregistered proxies: applications filed for another person without an electronic authorisation or a valid power of attorney.
• Low-assurance access to sensitive data: attempts to reach register data with means below the high level required.
• Impersonation of authorities: forged documents and notices circulated on social networks in a regulator's name; the Commission for Personal Data Protection warned on 21 October 2026 that it serves documents only through legally prescribed channels.

9. Enforcement and penalties

Penalties are administrative and are imposed under the Administrative Violations and Sanctions Act. Amounts below are as stated in the consolidated texts cited, in leva.

Repeat breaches of the Electronic Identification Act carry double the amount (Art. 49). Under the Electronic Governance Act, officials designated by the minister responsible for e-government draw up the violation reports and the minister issues penalty decrees (Art. 65); under the Electronic Identification Act the Minister of Interior does so (Art. 50). Data protection breaches fall under GDPR Article 83 and are enforced by the Commission for Personal Data Protection.

10. Recent changes and what to watch

• December 2026 [Adopted, applies Dec 2026] Bulgaria must provide at least one European Digital Identity Wallet within 24 months of the wallet implementing acts, published on 4 December 2024 (Regulation (EU) 2024/1183, Art. 5a(1)). Public online services must then accept wallets.
• 1 September 2026 [In force] Rules of Organisation of the Ministry of Innovation and Digital Transformation take effect, consolidating e-government and eID policy in the new ministry.
• 20 August 2026 [Draft, not adopted] Summary of comments on the draft wallet law published; no final Council of Ministers act yet. Expect relying-party acceptance duties and a free state wallet.
• 8 May 2026 [In force] The National Assembly creates the Ministry of Innovation and Digital Transformation from the Ministry of e-Government and the Ministry of Innovation and Growth.
• 13 February 2026 [In force] Cybersecurity Act amended (State Gazette No. 17 of 2026) to implement NIS 2, covering administrative bodies and public e-service providers.
• December 2027 [Adopted, applies Dec 2027] Larger private relying parties required to use strong user authentication must accept wallets on request, 36 months after the implementing acts (Art. 5f(2)).

11. What this means for identity verification

• Support several means at once. While the interim means remain recognised, flows must accept qualified signatures, agency access codes and notified schemes, all routed through the state authentication system.
• Design to an eIDAS level. Map every credential to low, substantial or high; services touching register data need high.
• Plan for the wallet. Build for presentation of person identification data from European Digital Identity Wallets alongside existing means.
• Treat document images with care. Storing a copy of an identity document needs a statutory basis; prefer chip reading or verified attributes where the law allows.
• Check document validity. The Ministry of Interior's online check confirms whether a Bulgarian document is valid, which matters as non-compliant identity cards phase out by August 2031.
• Re-verify on change. Changes to name, personal number or document status should trigger re-verification, mirroring the revocation grounds for eID certificates.