Bulgaria applies GDPR standards to recruitment, and its labour law adds a further constraint that catches out employers used to more permissive systems. An employer may only require the documents that law actually specifies for the position.
What employers can check
Identity, employment history, and academic qualifications are all legitimate. The employment record book and social security records give a reliable picture of previous work. Diplomas can be confirmed with the issuing institution, and foreign qualifications need recognition before they can be relied on for regulated roles.
Criminal record checks
The document is the certificate of criminal record, the svidetelstvo za sudimost, issued by the regional court covering the candidate’s place of birth, and also available through an electronic service for those with no convictions recorded. Employers should not ask for one as a matter of routine. It can be required where a law or regulation makes a clean record a condition of the position, which covers banking and finance, private security, education, healthcare, public sector roles, and work with children.
Data protection
The GDPR applies alongside Bulgarian implementing law, supervised by the Commission for Personal Data Protection. Criminal record data attracts additional protection. Consent is a weak basis in the employment context, so rely on a legal obligation or on necessity for the role, be transparent about the purpose, collect the minimum, and delete unsuccessful applicants’ data once recruitment closes.
Medical checks
A pre-employment medical certificate is required when someone starts work for the first time or returns after a long break, and additional occupational health checks apply in specific sectors. Scope should stay tied to fitness for the role.
Practical guidance
Check whether a criminal record certificate is actually required for the position before requesting one, keep a written justification, and apply the process consistently. An employer of record can manage this if you have no Bulgarian entity.

