News · GDPRhub EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.

BAC (Bulgaria) - 2984/2026

Personal Data Controllers Financial Sector Right of Access Procedures
Oct 14, 2026 Source gdprhub.eu

Full text

Machine translation of the decision, via GDPRhub — not the official text.

The Bulgarian Supreme Administrative Court upheld that a controller had failed to comply fully with its obligations under Article 15 GDPR]] by providing only an extract from its records to a data subject, instead of the requested document copies. English Summary. Facts. The data subject requested that the controller (a Bulgarian non-banking financial institution specialized in providing online fast loans and installment loans) provide copies of all documents containing their personal data, including loan agreements, credit applications, and information about payments made under their contracts. The controller provided only an extract from its records and information about the processing of the data, without supplying copies of the requested documents. The Administrative Court of the city of Lovech annulled the controller's refusal and ordered the company to reconsider the request in accordance with the law. It held that the company had failed to fulfil the individual’s right of ac

How it connects

Related across sources

C/09/697386 / HA ZA 26-52 Den Haag District Court: 51 gamblers sue Unibet operator Risepoint over unanswered GDPR The District Court of The Hague (the Court) considered an action brought by 51 individuals who had participated in online gambling offered through the website Unibet before 1… Rb. Den Haag Sep 2, 2026 Right of Access Personal Data Data Portability
€277,500 Permanent TSB: Insufficient technical and organisational measures to ensure information security Data Protection Authority of Ireland fined Permanent TSB €277,500 on 2026-05-08 for: Insufficient technical and organisational measures to ensure information security. Ireland ·DPC ·Art. 5, 32, 33 May 8, 2026 Integrity and Confidentiality Principle Notification Obligation Data Breaches
Related documents