Data protection & privacy law in Bulgaria (2026)

Legal framework

EU GDPR (Regulation (EU) 2016/679) directly applicable, supplemented by Bulgaria's Personal Data Protection Act (PDPA, State Gazette No. 17/26.02.2019, in force 2 March 2019); supervised by the Commission for Personal Data Protection (CPDP)

GDPR & data protection in Bulgaria

In Bulgaria, data protection is governed by the EU General Data Protection Regulation (GDPR), which applies directly and is enforced by the Commission for Personal Data Protection (CPDP).

Framework

the GDPR (Regulation (EU) 2016/679) plus the national data-protection act

Supervisory authority

the Commission for Personal Data Protection (CPDP)

Applies to

any organisation processing the personal data of people in Bulgaria, wherever the organisation is based

Maximum fine

€20 million or 4% of global annual turnover, whichever is higher

Breach notification

within 72 hours of becoming aware, to the supervisory authority

DPO

required for large-scale monitoring or large-scale special-category processing

The GDPR is bloc-wide; Bulgaria supplements it with a national data-protection act and its own supervisory authority.

Key points: data & privacy in Bulgaria

1. 01Primary Legal Basis

   The GDPR applies directly as EU law. The national PDPA (State Gazette No. 17/26.02.2019) supplements it without repeating GDPR provisions, exercising national discretions permitted by Articles 6(2), 9(4), and 88, replacing the prior 2002 Data Protection Act.

   whitecase.com cms.law

2. 02Supervisory Authority

   The Commission for Personal Data Protection (CPDP), an independent body comprising a chairman and four members, is the lead supervisory authority for both GDPR and PDPA compliance. The Inspectorate to the Supreme Judicial Council holds concurrent competence exclusively for data processing by courts, prosecution offices, and criminal investigative bodies acting as judicial authorities.

   cpdp.bg dlapiperdataprotection.com

3. 03National PDPA Specifics

   The PDPA addresses areas where GDPR grants member-state discretion: employment-related data processing, a 14-year age threshold for children's consent to information-society services, use of personal identification numbers, freedom of expression and journalism exemptions, and processing of data belonging to deceased individuals.

   gdprhub.eu cms.law

4. 04Enforcement Record

   The largest GDPR enforcement action in Bulgaria was a BGN 5.1 million (~€2.61 million) fine against the National Revenue Agency following unlawful access and online distribution of personal data of more than 6 million individuals. Routine CPDP sanctions have generally been modest (BGN 1,000-10,000), partly due to resource constraints and governance issues within the commission.

   pinsentmasons.com cms.law

5. 05Whistleblower Protection Integration

   Since May 2023, the CPDP has been additionally designated as the competent controlling body under the Bulgarian Whistleblower Protection Act, expanding its regulatory remit beyond personal data supervision.

   whitecase.com cms.law

6. 06NIS2 & Harmonised Incident Reporting

   Bulgaria's Cybersecurity Act amendments transposing the NIS2 Directive entered into force on 17 February 2026 following significant delay (the EU Commission issued a reasoned opinion for non-transposition in May 2025). The framework establishes a single-entry notification point harmonising breach-reporting obligations across NIS2, GDPR, DORA, and eIDAS.

   chambers.com digital-strategy.ec.europa.eu

GDPR in Bulgaria: FAQ

Timeline of decisions

1. 1 Jan 2024Decision
   CPDP 2024 Activity Report: Minimal Published Decisions, Sector Focus Identified

   The CPDP's 2024 activity report (budget BGN 6.4 M / ~EUR 3.27 M) recorded no individually published decisions, with enforcement concentrated in telecom, postal operators, online betting, fast crediting, private enforcement agents, and direct marketing. Bulgaria's average sanction continues to rank among the lowest in the EU, reflecting the regulator's conservative posture.

   CMS GDPR Enforcement Tracker 2024

2. 15 Nov 2019Decision
   Constitutional Court Strikes Down PDPA's Journalistic-Exception Balancing Test

   Decision No. 8/2019 (Constitutional Case 4/2019) declared Article 25з(2) of the PDPA unconstitutional, finding its open-ended balancing criteria impermissibly elevated privacy rights over freedom of expression. The ruling created a legislative vacuum: Bulgaria lost its GDPR Article 85 implementing provision, leaving the scope of the journalistic exemption unresolved.

   AmCham Bulgaria (reporting on Constitutional Court Decision 8/2019)

3. 29 Aug 2019Enforcement
   CPDP Fines National Revenue Agency BGN 5.1 Million, First Major GDPR Enforcement Action

   The Commission for Personal Data Protection (CPDP) imposed a BGN 5.1 million (~€2.6 million) fine on the National Revenue Agency for failing to implement adequate technical and organizational security measures following Bulgaria's largest-ever personal data breach. It was one of the earliest and largest GDPR enforcement actions in Central and Eastern Europe.

   IAPP (citing CPDP decision)

4. 29 Aug 2019Enforcement
   NRA Fined BGN 5.1 Million, Bulgaria's Record GDPR Sanction

   The CPDP imposed a BGN 5,100,000 (~EUR 2.6 million) fine on the National Revenue Agency under GDPR Article 32 for failing to maintain adequate security over databases holding fiscal and personal data of millions of citizens. This remains the largest privacy fine in Bulgarian history and triggered lasting debate about state-sector cyber-governance.

   Wolf Theiss (citing CPDP decision, August 2019)

5. 15 Jul 2019Incident
   National Revenue Agency Mega-Breach Exposes Data of 5 Million+ Bulgarians

   A hacker breached the NRA's online tax-return infrastructure and exfiltrated ~11 GB of records encompassing the personal and fiscal data of over five million citizens, effectively Bulgaria's entire adult population, leaking the dataset to national media. It was, and remains, the country's largest data breach on record.

   BankInfoSecurity

6. 1 Mar 2019Law
   Revised PDPA Enters into Force: GDPR and Law Enforcement Directive Implemented

   The comprehensively amended Personal Data Protection Act (promulgated State Gazette No. 17, 26 February 2019) took effect on 1 March 2019, formally designating the CPDP as Bulgaria's GDPR supervisory authority, transposing the EU Law Enforcement Directive (2016/680), and adding sectoral rules for employment data, recruitment records, and children's data. The law closed a nine-month gap during which GDPR applied but Bulgaria lacked a designated DPA.

   CMS Law (citing State Gazette No. 17/2019)

7. 23 May 2002Decision · official
   Parliament Establishes the Commission for Personal Data Protection (CPDP)

   By parliamentary decision of 23 May 2002, Bulgaria elected the founding members of the CPDP, a Chair and four Members, operationalising the supervisory framework mandated by the January 2002 PDPA. The Commission has since served as Bulgaria's sole independent data-protection regulator for both the public and private sectors.

   CPDP — Official History

8. 4 Jan 2002Law · official
   Personal Data Protection Act Enacted, Bulgaria's Foundational Privacy Law

   Promulgated in State Gazette No. 1 of 4 January 2002 and entering into force on 1 January 2002, the PDPA transposed EU Directive 95/46/EC. It established data-subject rights, controller obligations, a registration regime, and the legal basis for an independent supervisory authority, marking Bulgaria's integration into the EU privacy framework ahead of its 2007 accession.

   CPDP — Personal Data Protection Act (official text)

Sources

1. 1.cpdp.bg/en/
2. 2.whitecase.com/insight-our-thinking/gdpr-guide-national-implementation-bulgaria
3. 3.cms.law/en/int/expert-guides/cms-expert-guide-to-data-protection-and-cyber-se
4. 4.gdprhub.eu/Data_Protection_in_Bulgaria
5. 5.dlapiperdataprotection.com/index.html?t=law&c=BG
6. 6.pinsentmasons.com/out-law/news/gdpr-fines-for-data-breaches-in-bulgaria
7. 7.cms.law/en/lux/publication/gdpr-enforcement-tracker-report/bulgaria
8. 8.chambers.com/articles/bulgaria-s-long-road-to-nis2-is-over
9. 9.digital-strategy.ec.europa.eu/en/policies/nis2-directive-bulgaria
10. 10.cpdp.bg/en/commission-for-personal-data-protection-cpdp/