Ordinance No. 62 of 30.10.2018 on the procedure for storage, use and destruction by pension insurance companies of documents and data related to supplementary pension insurance activity

ORDINANCE No. 62 of 30.10.2018 on the procedure for storage, use and destruction by pension insurance companies of documents and data related to supplementary pension insurance activity Promulgated - State Gazette, issue 94 of 13.11.2018, effective 19.11.2018; amended and supplemented, issue 60 of 20.07.2021; amended, issue 70 of 20.08.2024; amended and supplemented, issue 73 of 14.08.2026, effective 01.01.2027. Adopted by Decision No. 1023-H of 30.10.2018 of the Financial Supervision Commission

Section I
General Provisions
Art. 1. This ordinance regulates the procedure for storage, use and destruction by pension insurance companies of documents and data related to supplementary pension insurance activity.
Art. 2. (1) The management body of the pension insurance company adopts rules for the storage, use and destruction of documents and data related to supplementary pension insurance activity.
(2) The rules shall regulate:

1. the storage periods for individual types of documents and data;
2. the specific measures and procedures applied by the company in connection with the storage, use and destruction of documents and data related to supplementary pension insurance activity;
3. the responsible units and employees for implementing the measures and procedures under item 1;
4. the rules for the work of the expert commission under Art. 9, para 1.
   (3) The pension insurance company shall submit the rules under para 1 to the Financial Supervision Commission within 7 days of their adoption, respectively, from the adoption of amendments and supplements thereto.

Section II
Storage of documents and data
Art. 3. (Amended and supplemented - SG, issue 60 of 2021; amended, issue 70 of 2024; amended and supplemented, issue 73 of 2026, effective 01.01.2027) (1) Unless another period is provided for the respective type of documents or data in a normative act, the pension insurance company shall store the documents and data related to supplementary pension insurance activity for the following minimum periods:
1. (supplemented - SG, issue 60 of 2021) orders for investing the funds of supplementary pension insurance funds and payment funds and the analyses and proposals prepared in connection therewith - 5 years from the execution of the respective investment;
2. (amended - SG, issue 60 of 2021; supplemented, issue 73 of 2026, effective 01.01.2027) information on prices and their sources, on the basis of which the assets and liabilities of the pension insurance company and the funds, respectively sub-funds, managed by it are valued, and decisions for selecting prices for asset valuation - 5 years from the valuation;
3. biometric tables and actuarial calculations - 5 years from the approval of new ones;
4. (amended - SG, issue 73 of 2026, effective 01.01.2027) documents certifying the compliance of the members of the management and control body, procurators, responsible actuary and persons under Art. 123v, para 2 and 10 of the Social Security Code with the requirements provided for these persons in the Social Security Code - 5 years from the termination of the legal relationship with the respective person;
5. minutes from the meetings of the management and control bodies of the pension insurance company and of the general meeting of shareholders - 5 years from the date of the respective meeting;
6. (amended - SG, issue 70 of 2024; amended, issue 73 of 2026, effective 01.01.2027) contracts with external contractors, the responsible actuary, persons under Art. 123v, para 2 and 10 of the Social Security Code, custodian banks, depositories, insurance undertakings under Art. 246a, para 1 of the Social Security Code and insurance intermediaries - 5 years from the termination of the contract;
7. monthly, quarterly and annual reports for supervisory purposes and statements submitted to the Financial Supervision Commission - 5 years from the expiry of the period to which they relate;
8. reports and statements prepared by the specialized internal control service, the risk management unit and the unit, respectively the person, performing internal audit - 5 years from their preparation;
9. reports on the activity of the company's bodies submitted to the general meeting of shareholders, for which no special storage period is provided - 5 years from the meeting of the general meeting at which the respective report was reviewed;
10. applications for participation, applications for resumption of insurance and related documents, when no insurance legal relationship has arisen with the respective person - 2 years from the receipt of the application;
11. (amended - SG, issue 70 of 2024; amended, issue 73 of 2026, effective 01.01.2027) applications for transfer of funds, applications for change of PEPP provider and related documents, when the respective application is cancelled or the procedure for transfer of funds or for change of PEPP provider is terminated - 2 years from the date under Art. 9, para 2, respectively - Art. 14, para 1 or Art. 18, para 1 of Ordinance No. 3 of 16 July 2026 on the change of participation and transfer of funds of an insured person in a supplementary pension insurance fund (SG, issue 68 of 2026) or the date of receipt of the application by the receiving PEPP provider;
12. documents other than those specified in items 1 - 11 - for a period determined in the rules under Art. 2, para 1, in compliance with the applicable personal data protection requirements;
13. other documents for which no special storage period is provided in the normative framework and in the rules under Art. 2, para 1 - 1 year from the cessation of the use of the document.
(2) Longer periods than those specified in para 1 may be determined in the rules under Art. 2, para 1, in compliance with the applicable personal data protection requirements.
(3) When two different storage periods are provided for a specific document on different grounds, the longer of them shall apply.
(4) In compliance with the applicable personal data protection requirements, specific documents and data may continue to be stored after the expiry of the periods under para 1, respectively para 2, at the discretion of the expert commission under Art. 9, para 1. Art. 4. (1) The pension insurance company shall store documents and data in special premises that ensure their physical preservation, protection from infringements and their arrangement in a manner suitable for searching. (2) The premises under para 1 shall not be used for other purposes. (3) The premises under para 1 must meet the following requirements:
1. to be fire-safe;
2. to be dry, easily ventilated and isolated from direct sunlight;
3. no sewage, heating or gas pipelines shall pass through them;
4. the electrical installation must be enclosed; the use of open lighting and heating appliances is not allowed;
5. the spatial arrangement must ensure easy and convenient access to the stored documents;
6. to be secured with means for restricting physical access through reliable locking systems and with means for emergency access.
(4) The following temperature and humidity parameters shall be constantly maintained in the premises under para 1:
1. for paper documents: temperature from 14 to 18 °С and relative humidity of 50 ± 5 percent;
2. for electronic data carriers: temperature 18 °С ± 2°С and relative humidity 40 percent ± 5 percent.
(5) For control of temperature and humidity parameters, a thermometer and hygrometer or thermohygrograph must be present in the premises under para 1, and the data shall be recorded weekly in a logbook.
(6) A thorough cleaning of the premises under para 1, combined with disinfection, disinsection and deratization, shall be carried out twice a year.
Art. 5. (1) Access to the premises under Art. 4, para 1 shall be granted only to:
1. employees of the company, respectively of the specialized external contractor, responsible for the storage of documents;
2. in the presence of the employees under item 1 - employees of the company whose official duties include the use of documents or electronic data carriers stored in the premises, and employees of state control bodies.
(2) An account shall be kept for each visit and use of documents and electronic data carriers from the premises under Art. 4, para 1.

Section III
Use of documents and data
Art. 6. The pension insurance company, its employees and the persons to whom it has contractually assigned certain activities:

1. may use documents and data related to supplementary pension insurance activity only in connection with its performance;
2. are obliged to protect the confidentiality of documents and data and may provide them to third parties only in cases where this is provided for by law.
   Art. 7. (1) The removal of originals of documents and electronic data carriers outside the pension insurance company, respectively outside the premises under Art. 4, para 1 of the external contractor, for their provision to external users shall be carried out after written permission from the persons managing and representing the pension insurance company, or from an employee of the company explicitly authorized by them. When documents are sent with a letter signed by the persons managing and representing the pension insurance company, a separate written permission is not required. (2) A transfer and acceptance protocol shall be drawn up for the removal and return of documents and electronic data carriers under para 1, describing the specific documents, respectively carriers, that are provided. (3) Before providing an original document or electronic data carrier to an external user, a copy of the original, respectively of the carrier, shall be made, which shall be stored until the return of the original, respectively of the carrier. (4) If deficiencies and damages are found after the return of documents or electronic data carriers, a protocol shall be drawn up and submitted to the persons managing and representing the pension insurance company.

Section IV
Destruction of documents and data
Art. 8. Documents and data related to supplementary pension insurance activity shall be destroyed only after the expiry of the periods under Art. 3, para 1, respectively para 2, unless the conditions under para 3 of the same article are met. Art. 9. (1) Destruction shall be carried out after an assessment of the grounds for it by an expert commission, established by order of the persons managing and representing the pension insurance company. (2) The expert commission shall review the documents and data and assess the need for their destruction at least once a year. (3) The expert commission shall draw up a protocol describing the types of documents and data subject to destruction, and their subject matter and quantity. (4) The destruction of documents and data described in the protocol under para 3 shall be carried out after prior approval by the persons managing and representing the pension insurance company. Art. 10. Destruction shall be carried out in a manner that prevents the recovery of documents and data and unauthorized access to them.

Section V
Outsourcing activities to external contractors Art. 11. (1) The pension insurance company may assign the activities of storing and/or destroying documents to a specialized external contractor by written contract. In this case, the company:

1. is responsible for the actions of the external contractor as for its own actions;
2. provides in the contract with the external contractor for obligations to protect the confidentiality of the provided documents and information and for assistance from its side to the bodies and employees of the Financial Supervision Commission in the exercise of their powers;
3. monitors and assesses the risks associated with the outsourcing of activities, as well as their performance by the external contractor.
   (2) The specialized external contractor and its employees and subcontractors are obliged to carry out the assigned activities in compliance with the requirements established for the pension insurance company and the rules adopted by the company under Art. 2, para 1. (3) The pension insurance company shall submit to the Financial Supervision Commission a certified copy of the contract with the specialized external contractor within 7 days of its conclusion, respectively amendment or supplement, and shall notify the Commission within 7 days of the termination of the contract.

Final Provisions
§ 1. In Ordinance No. 3 of 2003 on the procedure and manner for changing participation and for transferring accumulated funds of an insured person from one supplementary pension insurance fund to another corresponding fund, managed by another pension insurance company (promulgated, SG, issue 90 of 2003; amended and supplemented, issue 9 of 2004; amended, issue 85 of 2004, issue 50 of 2005; corrected, issue 52 of 2005; amended, issue 7 of 2006; amended and supplemented, issue 78 of 2011, issue 1 of 2016; amended, issue 62 of 2016; amended and supplemented, issue 10 of 2018) Art. 21b is repealed. § 2. In Ordinance No. 33 of 2006 on individual applications for participation in a supplementary mandatory pension insurance fund and for resumption of insurance in a universal pension fund (title amended, SG, issue 62 of 2016) (promulgated, SG, issue 83 of 2006; amended, issue 57 of 2012; amended and supplemented, issue 64 of 2012, issue 67 of 2014, issue 62 of 2016, issue 10 of 2018) Art. 5a is repealed. § 3. In Ordinance No. 47 of 2012 on the requirements for the information systems of pension insurance companies (SG, issue 57 of 2012) in Art. 8, para 3 the words