> Bulgaria's whistleblowing act: the 50-worker rule, CPDP's dual role, and the official implementation guidance for obliged entities. Source: https://ethicsportal.eu/whistleblower-laws/bulgaria/ Updated: 2026-06-10 --- # Whistleblower law in Bulgaria Bulgaria implemented Directive (EU) 2019/1937 through the **Act on the Protection of Persons Reporting Information or Publicly Disclosing Information about Breaches**, in force since **4 May 2023**. The Bulgarian system is notable because the CPDP acts both as the central external authority and as the data protection authority. ## Applicable law - [ЗЗЛПСПОИН — full consolidated text (lex.bg)](https://lex.bg/bg/laws/ldoc/2137231156) - [ЗЗЛПСПОИН — official text PDF (gov.bg)](https://www.navet.government.bg/bg/media/zakon_za_zasita_na_licata_podavasi_signali_ili_publicno_opovestqvasi_informaciq_za_naruseniq-19052023.pdf) - [Bulgarian whistleblowing act — official CPDP law page](https://cpdp.bg/%D0%BF%D1%80%D0%B0%D0%B2%D0%BD%D0%B0-%D1%80%D0%B0%D0%BC%D0%BA%D0%B0-%D0%BD%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%B0%D0%BB%D0%BD%D0%B0/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%B7%D0%B0-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B0-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%86%D0%B0%D1%82%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D1%89%D0%B8-%D1%81%D0%B8%D0%B3/?hilite=%D0%B7%D0%B0%D0%BF%D0%BE%D0%B2%D0%B5%D0%B4+%E2%84%960496+04.05.2023) - [CPDP implementation guidance](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/) ## Who must establish an internal channel - **All in-scope public-sector bodies** (obliged organisations under the Financial Management and Control in the Public Sector Act) — regardless of headcount. - **Private employers with 50 or more workers.** - Phased: public sector and private employers with 250+ workers from **4 May 2023**; the **50-249** band from **17 December 2023**. A 2025 amendment (in force May 2025) **removed the option to use a shared group-level internal channel** — each obligated entity must now establish and maintain its own. ## Penalties and enforcement Unlike most member states, Bulgaria fixes an **explicit fine for failing to establish a channel** — Article 41 ([Чл. 41](https://lex.bg/bg/laws/ldoc/2137231156)) penalises any entity that does not fulfil the channel-establishment duty under Article 13(1)–(2). The structure is dual-tier (natural vs. legal person) and escalates on repeat. EUR figures use the fixed peg (1.95583 BGN/€). | Conduct | Article | Fine | ≈ EUR | | --- | --- | --- | --- | | **No internal channel — legal person / sole trader, first violation** | Чл. 41(2) | **BGN 5,000–20,000** | **~€2,500–10,000** | | No internal channel — legal person, repeat violation | Чл. 41(3) | BGN 10,000–30,000 | ~€5,000–15,000 | | No internal channel — natural person | Чл. 41(1) | BGN 1,000–5,000 | ~€500–2,500 | | Obstructing a report or failing to act on / report follow-up | Чл. 42 | BGN 400–4,000 | ~€200–2,045 | | Retaliation against a reporter, or malicious proceedings | Чл. 43 | BGN 2,000–8,000 | ~€1,000–4,090 | Verbatim, Art. 41(1)–(2): *"Наказва се с глоба в размер от 1000 до 5000 лв. … лице, което не изпълни задължение по чл. 13, ал. 1 и 2. … Когато нарушението … е извършено от юридическо лице или едноличен търговец, се налага имуществена санкция в размер от 5000 до 20 000 лв."* **An honest assessment of enforcement.** The fines above are what the law provides. In practice, enforcement to date is modest and largely reactive. The CPDP's official 2024 figures record [97 reports received](https://cpdp.bg/28300-2/) (35 within the Directive's scope), seven inspections closed for lack of sufficient evidence, and **only one resulting in a sanction**, with total sanctions for the year of **BGN 17,400 (~€8,900)**. No company has been publicly named, and none of these is identified as a specific failure-to-establish-channel case. The practical conclusion mirrors the rest of the region: the obligation is real, but the exposure is a report reaching the CPDP with no channel in place — not a large fine. ## External reporting authority The central external channel is the [Commission for Personal Data Protection (CPDP)](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/), which also publishes forms, register guidance and FAQs for obliged entities. ## Data protection authority The same [CPDP](https://cpdp.bg/%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B6%D0%B0%D0%BB%D0%B1%D0%B8-%D0%B8-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%B4%D0%BE-%D0%BA%D0%B7%D0%BB%D0%B4/) is Bulgaria's GDPR supervisory authority. ## Key compliance points - Municipalities with fewer than 10,000 inhabitants or fewer than 50 workers may share resources for intake and follow-up. - Private entities with 50-249 workers may also share resources for receiving and handling reports. - CPDP's official materials expect a non-public register of reports and clear public information about how to use the channel. ## Official sources - [ЗЗЛПСПОИН — full consolidated text (lex.bg)](https://lex.bg/bg/laws/ldoc/2137231156) — penalties in Chapter Four, *Административнонаказателни разпоредби* (Art. 41 = failure to establish a channel) - [ЗЗЛПСПОИН — official text PDF (gov.bg)](https://www.navet.government.bg/bg/media/zakon_za_zasita_na_licata_podavasi_signali_ili_publicno_opovestqvasi_informaciq_za_naruseniq-19052023.pdf) - [Bulgarian whistleblowing act — official CPDP law page](https://cpdp.bg/%D0%BF%D1%80%D0%B0%D0%B2%D0%BD%D0%B0-%D1%80%D0%B0%D0%BC%D0%BA%D0%B0-%D0%BD%D0%B0%D1%86%D0%B8%D0%BE%D0%BD%D0%B0%D0%BB%D0%BD%D0%B0/%D0%B7%D0%B0%D0%BA%D0%BE%D0%BD-%D0%B7%D0%B0-%D0%B7%D0%B0%D1%89%D0%B8%D1%82%D0%B0-%D0%BD%D0%B0-%D0%BB%D0%B8%D1%86%D0%B0%D1%82%D0%B0-%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D1%89%D0%B8-%D1%81%D0%B8%D0%B3/?hilite=%D0%B7%D0%B0%D0%BF%D0%BE%D0%B2%D0%B5%D0%B4+%E2%84%960496+04.05.2023) - [CPDP — implementation of the protection system](https://cpdp.bg/en/whistleblowers-protection/implementation-of-the-system-for-protection-of-persons-reporting-or-publicly-disclosing-information-about-breaches/) - [CPDP — frequently asked questions](https://cpdp.bg/en/frequently-asked-questions-on-the-wpa/) - [CPDP — complaints and signals](https://cpdp.bg/%D0%BF%D0%BE%D0%B4%D0%B0%D0%B2%D0%B0%D0%BD%D0%B5-%D0%BD%D0%B0-%D0%B6%D0%B0%D0%BB%D0%B1%D0%B8-%D0%B8-%D1%81%D0%B8%D0%B3%D0%BD%D0%B0%D0%BB%D0%B8-%D0%B4%D0%BE-%D0%BA%D0%B7%D0%BB%D0%B4/) - [CPDP — 2024 whistleblower enforcement statistics](https://cpdp.bg/28300-2/) - [EU Whistleblowing Monitor — Bulgaria](https://whistleblowingmonitor.eu/country/bulgaria/) --- [Deploy your reporting channel →](/pricing/)