Bulgaria Data Protection & Privacy Regulation

Controller/Processor Duties

Bulgaria's breach-notification environment showed an elevated volume in 2025: 112 breach notifications were recorded, with approximately 2.5 million data subjects affected, and 87 percent of these breaches attributed to external hacking attacks. This figure is understood to reflect an escalating trajectory in controller and processor breach-reporting activity, though it has not been independently confirmed against CPDP primary data this cycle and rests on law-firm commentary.

Separately, a Sofia City Administrative Court decision dated 5 January 2026 reduced the financial penalty against Bulgarian Post EAD arising from its 2022 data-breach case. This court-driven reduction is a material development for how breach-related enforcement outcomes should be read: it indicates that CPDP enforcement figures in this area are subject to judicial moderation on appeal, tempering the practical weight of headline penalty figures.

Outlook

The trajectory to watch is whether the elevated 2025 breach-notification volume continues into 2026, and whether further judicial reductions of CPDP breach-related penalties follow the Bulgarian Post EAD pattern, which would reinforce the signal that appeal mechanisms are functioning as a meaningful check on enforcement outcomes.

Cross-Border & Adequacy

Regulation (EU) 2025/2518 is understood to lay down additional procedural rules for the enforcement of the GDPR in cross-border cases, and is reported to apply from April 2027. This is a forward-dated, not-yet-effective instrument that will affect how the Commission for Personal Data Protection cooperates procedurally with other EU data protection authorities on cases involving cross-border data flows or multi-jurisdiction complaints once it becomes applicable.

Outlook

The item to watch as this cycle's horizon item approaches is how the CPDP prepares operationally for the April 2027 application date of Regulation (EU) 2025/2518, and whether any transitional guidance is issued in the interim regarding cross-border case handling.

Sectoral Watch

No Bulgarian national competent authority or data coordinator has been identified as designated under the EU Data Act, Regulation (EU) 2023/2854, within sources retrieved this period. This is recorded as a negative finding rather than a confirmed absence: the search for a Bulgarian designation under the Data Act may not have been exhaustive within the available research budget, so the correct reading is that no designation was located, not that none exists.

This sits alongside the separately-reported finding, in the same reporting window, that Bulgaria's DSA-designated bodies (the CEM and CPDP) remain operationally unempowered per the European Commission's 1 October 2026 letter of formal notice. Both findings point toward the same underlying pattern of EU-instrument designations in Bulgaria that exist nominally without clear operational follow-through, though the Data Act and DSA items are distinct instruments and should not be conflated as evidence of the same gap.

Outlook

A dedicated search for a Bulgarian Data Act national competent authority or data coordinator designation, beyond what was retrieved this period, would resolve whether the current negative finding reflects a genuine regulatory gap or simply an unretrieved designation.

Algorithmic, Biometric & Surveillance Governance

Bulgaria's implementation of the EU AI Act currently designates the Commission for Personal Data Protection among the bodies responsible for protecting fundamental rights under Article 77 of the Act, but two further designations required under the Act remain outstanding: the Article 70 market-surveillance authority and the national single point of contact. A national implementing bill intended to close this gap is scheduled for tabling in October 2026, following a consultation planned for September 2026, and appears as item 21 of the government's legislative programme under a Council of Ministers decision dated 29 July 2026. The bill has not been enacted, and whether it has in fact been tabled before the National Assembly on the scheduled timetable has not been independently confirmed this period.

Until the Article 70 authority is designated, Bulgaria's AI Act enforcement architecture carries an institutional gap at the market-surveillance layer specifically, distinct from the fundamental-rights protection layer that the Commission for Personal Data Protection's Article 77 role already covers. This leaves the practical question of who exercises day-to-day market-surveillance powers over AI systems placed on the Bulgarian market, as opposed to who protects individuals' fundamental rights in relation to those systems, unresolved pending the implementing bill's passage.

Outlook

The scheduled October 2026 tabling of the national implementing bill is the immediate item to watch; its passage would designate the Article 70 market-surveillance authority and the single point of contact currently missing. Confirmation that the bill has actually reached the National Assembly on this timetable, rather than remaining a scheduled legislative-programme item, is the specific gap that would need to close to move this from a proposed to an enacted designation.

Algorithmic, Biometric & Surveillance Governance

Bulgaria missed the 2 August 2025 deadline under AI Act Article 70 to designate its market-surveillance authority and single point of contact. As of mid-2026, that designation remains an unadopted draft, led informally by the Ministry of Electronic Governance rather than through a formally adopted instrument. In the absence of an Article 70 designation, the Commission for Personal Data Protection's (CPDP) role under the AI Act is currently limited to serving as one of the seven Article 77 fundamental-rights bodies, a role that runs alongside its standing GDPR remit. The CPDP has not been designated as the AI Act market-surveillance authority.

The practical consequence of this gap is that Bulgaria's AI Act enforcement architecture for market surveillance is not yet in place more than a year after the Article 70 deadline passed; the fundamental-rights-body function the CPDP already performs is a narrower role than full market-surveillance authority and does not substitute for it.

Outlook

Adoption of the draft market-surveillance designation currently led informally by the Ministry of Electronic Governance is the development that would resolve this gap. Until that designation is formally adopted, Bulgaria's AI Act market-surveillance function remains unresolved, and the CPDP's Article 77 fundamental-rights role is the only confirmed AI Act function it currently holds.

Algorithmic, Biometric & Surveillance Governance

Bulgaria's institutional architecture for the EU AI Act remains incomplete on one of its two principal designation tracks. The Commission for Personal Data Protection was designated as one of seven Article 77 fundamental-rights bodies by Council of Ministers Decision No. 398 of 18 June 2025, giving it a formal role in protecting fundamental rights potentially affected by high-risk AI systems. However, as of mid-2026, Bulgaria had not designated a market-surveillance authority under Article 70 of the AI Act, the body responsible for supervising compliance of AI systems placed on the market. The European Commission's own single-point-of-contact list for AI Act national authorities shows Bulgaria's entry as blank, which is independent confirmation that the gap is recognised at the EU level and not merely a matter of delayed public reporting.

The practical consequence of the undesignated Article 70 authority is that, as things stand, there is no confirmed body within Bulgaria exercising AI Act market-surveillance powers, even though the fundamental-rights protection strand has been operative since mid-2025. This asymmetry between the two institutional tracks leaves a supervisory gap specifically on the market-surveillance side of AI Act enforcement in Bulgaria.

Outlook

No date has been established for Bulgaria's designation of an Article 70 market-surveillance authority. Until that designation is made and reflected on the European Commission's single-point-of-contact list, Bulgaria's AI Act institutional architecture remains only partially complete.

Algorithmic, Biometric & Surveillance Governance

The Commission for Personal Data Protection is understood to have adopted, in 2025, an official opinion addressing the use of facial recognition technologies in shops. This is interpretive guidance rather than binding rulemaking, reflecting the regulator's evolving approach to biometric surveillance in commercial retail settings, and it has not been independently corroborated beyond a single secondary commentary source this cycle.

Outlook

The item to watch is whether this interpretive opinion is followed by binding rulemaking or enforcement action against a specific retailer's facial-recognition deployment, which would mark a shift from guidance to active supervision in this area.

Children & Vulnerable Groups

The CPDP's Annual Report for 2025 declares a focus on protecting minors' personal data online, marking children and vulnerable groups as an emerging priority area for Bulgarian data-protection supervision. This is reported at Probable confidence: the declared priority itself is reasonably well evidenced, but the practical supervisory activity that will follow from it, whether new guidance, targeted investigations, or enforcement action specifically concerning minors, has not yet been evidenced this cycle beyond the stated focus.

This declared focus sits alongside, but is currently distinct from, the CPDP's historical enforcement concentration in video surveillance and banking-sector complaints, which together dominate the Commission's current complaint volume. Whether the minors'-data priority will translate into a comparable volume of complaint or enforcement activity in future reporting periods is not yet established from the evidence available this cycle.

Outlook

Future cycles should watch for whether the CPDP's declared focus on minors' personal data online produces concrete regulatory output, such as targeted guidance, a dedicated enforcement action, or a measurable shift in complaint-category volume toward children's and vulnerable-groups matters, none of which has yet been evidenced.

Children & Vulnerable Groups

The Commission for Personal Data Protection's Annual Report for 2025 is understood to have declared a focus on protecting minors' personal data online. This reflects an active supervisory priority for the regulator going into the current cycle, though it does not, on the evidence available this cycle, constitute a new binding rule specific to children's data processing.

Outlook

The item to watch is whether this declared supervisory focus translates into concrete guidance, rulemaking, or enforcement action specifically targeting minors' data protection online in the coming cycles.

Enforcement & Redress

The European Commission is understood to have sent a further letter of formal notice to Bulgaria on 1 October 2026, continuing the infringement procedure numbered INFR(2024)2241, concerning Bulgaria's implementation of the Digital Services Act. The letter finds that Bulgaria is still failing to comply by not designating and empowering the Personal Data Protection Commission and the Electronic Media Council as the national competent authorities required under the Digital Services Act, and that Bulgaria has incorrectly implemented the Act's sanctioning powers at domestic level. Bulgaria has two months from the date of the letter to respond, placing the response deadline at approximately 1 December 2026.

This is a continuation of an existing infringement file rather than a new one, and the finding predates the current reporting window; it is carried here because it bears directly on the institutional capacity of Bulgaria's data protection and media regulators to exercise powers under the Digital Services Act, an area of standing relevance to this jurisdiction's enforcement posture. The substance of the Commission's finding is twofold: first, an institutional-designation gap, in that the Personal Data Protection Commission and the Electronic Media Council have not been formally empowered to act as Digital Services Act competent authorities; second, a sanctioning-powers gap, in that Bulgaria's domestic transposition of the Act's penalty regime is said to depart from what the Act requires.

Outlook

The near-term marker to watch is Bulgaria's response to the Commission, due by approximately 1 December 2026. Whether Bulgaria responds by formally empowering the Personal Data Protection Commission and the Electronic Media Council, and by correcting its sanctioning-power transposition, or whether the matter proceeds further within the infringement procedure, is unresolved as of the material reviewed. A failure to respond adequately would be the next event to track in this file; a move to designate and empower the two authorities would resolve the institutional-designation element of the Commission's finding.

Enforcement & Redress

Under the Personal Data Protection Act, breaches not covered by the GDPR carry a default administrative fine of up to BGN 5,000 (approximately EUR 2,500), doubled for a repeat breach within one year. This default fine cap applies to the narrower category of PDPA-only breaches that fall outside GDPR's own fining regime, and sits alongside the CPDP's broader GDPR enforcement powers.

On complaint volumes, video surveillance was the leading category of complaints received by the CPDP in 2025, with 425 complaints recorded, the clearest single indicator in the available evidence of where Bulgarian data-subjects are actively raising concerns. No new 2026 CPDP fine decision was located this period, so the enforcement-activity picture for this reporting window rests primarily on the complaint-volume figure rather than on a fresh sanction.

The CPDP's capacity to act on complaints is itself under scrutiny this period: the European Commission's 1 October 2026 letter of formal notice on DSA empowerment found that the CPDP, in its DSA-designated capacity, handled zero complaints or investigations in 2025, a finding that sits in tension with the 425 video-surveillance complaints recorded under its ordinary GDPR/PDPA remit and illustrates that institutional capacity appears to vary materially across the CPDP's different designated roles.

Outlook

Whether the CPDP records a 2026 fine decision, and how its DSA-related capacity gap identified in the Commission's letter is addressed within the two-month response window, are the two clearest markers to watch for this module going forward.

Enforcement & Redress

Bulgaria's enforcement picture this cycle is defined by a contrast between traditional GDPR enforcement activity and a near-total absence of DSA enforcement activity. On the GDPR side, the Commission for Personal Data Protection's 2025 complaint data shows video surveillance as the leading complaint category, with 425 complaints received, indicating that CPDP's day-to-day caseload remains concentrated in established subject matter. On the DSA side, the European Commission's additional letter of formal notice of 1 October 2026 records that Bulgaria handled zero DSA complaints in 2025 and opened zero formal DSA investigations across both 2024 and 2025, a finding that sits within the Commission's broader assessment that CPDP and the Electronic Media Council remain unempowered as DSA competent authorities.

Structurally, CPDP does not itself execute enforcement of the fines and administrative measures it imposes; matters proceed via a separate administrative procedure under the Administrative Infringement and Penalties Act, a procedural feature that affects how quickly a CPDP decision translates into an enforced outcome. CPDP's approved 2025 budget was approximately EUR 3.5 million, of which 95.92% was spent, giving a sense of the regulator's operating scale relative to its enforcement caseload.

On judicial review of CPDP decisions, the Sofia City Administrative Court, in a decision dated 5 January 2026, reduced a CPDP financial penalty against Bulgarian Post EAD to BGN 10,000. The underlying finding was that Bulgarian Post EAD's inadequate technical and organisational measures had caused unauthorised access to customers' personal, identity, financial and health-related data. The court's reduction of the penalty illustrates that CPDP's enforcement decisions are subject to meaningful substantive review on appeal, and that the administrative-penalty amount CPDP sets is not necessarily the amount ultimately upheld.

Outlook

Bulgaria's response to the EC's DSA infringement letter, due on or around 1 December 2026, is the key near-term marker for whether the DSA enforcement gap narrows. Separately, further judicial decisions reviewing CPDP penalties, following the pattern of the Bulgarian Post EAD reduction, are worth tracking as a signal of how CPDP's administrative penalties fare on appeal.

Enforcement & Redress

Bulgaria's enforcement and redress posture is defined this cycle by a transparency contraction at the Commission for Personal Data Protection (CPDP). The CPDP is understood to have published no publicly available enforcement decisions in either 2024 or 2025, a reversal from an earlier practice of publishing selected decisions. This claim is sourced to Tier-3 commentary rather than the CPDP's own decisions register, and has not been independently corroborated against that register this cycle, so the finding should be read as probable rather than settled fact.

The CPDP's formal sanctioning power has not diminished alongside this apparent publication gap. The CPDP may impose administrative fines of up to EUR 20,000,000 or 4% of worldwide annual turnover under Article 83 GDPR, the standard ceiling applied across GDPR supervisory authorities, together with non-monetary sanctions including warnings and injunctions. The combination of a confirmed, unchanged, high statutory ceiling and a reported absence of published decisions creates an interpretive tension: either enforcement activity has genuinely slowed, or it continues but is no longer being made public in the way it once was. The evidence available this cycle does not resolve which explanation applies.

A separate and independently significant redress development is the Bulgarian Supreme Administrative Court's referral of questions on state liability for GDPR-breach damages to the Court of Justice of the European Union for a preliminary ruling. The referral arises from the National Revenue Agency's 2019 data leak, a long-running matter now reaching the CJEU on the specific question of whether and how the Bulgarian state can be held liable in damages for the consequences of that breach. This is a pending referral, not a decided case, and the evidence available this cycle does not establish an expected ruling date.

Read together, the two developments describe an enforcement and redress landscape in Bulgaria that is more active in the courts than it appears to be in the regulator's own public decision-making record. The private right of action against the state, now before the CJEU, sits alongside a regulator whose own visible enforcement footprint has contracted.

Outlook

The CJEU's eventual ruling on state liability for GDPR-breach damages will be the most consequential development to watch, though no expected timeline has been established this cycle. In parallel, confirming or disconfirming the CPDP's reported 2024-2025 decision-publication gap against the CPDP's own public register would materially change how the enforcement posture should be read: a genuine slowdown in enforcement activity is a different finding from a change in publication practice that leaves underlying enforcement unaffected. Neither has been distinguished by the evidence available this cycle.

Enforcement & Redress

The CPDP's complaint data for 2025 shows a clear concentration pattern: video surveillance leads with 425 complaints, followed by banks and credit institutions in second place with 131 complaints. The banking-sector complaints chiefly concern unlawful disclosure of personal data to debt collectors, a specific and identifiable friction point rather than a diffuse category of financial-sector grievance. Both figures are reported at Probable confidence, sourced from CMS's GDPR enforcement tracker report on Bulgaria.

The Commission's largest sanction on record is a fine issued against the National Revenue Agency following a large-scale personal-data breach, underlying figure BGN 5.1 million, with minor variation across sources in the EUR-equivalent conversion reported. This remains the CPDP's most significant punitive action to date and demonstrates that the Commission's largest enforcement outcome to date has been directed against a state body rather than a private-sector controller. Separately, most CPDP punitive proceedings in the recent reporting period concern processing without a legal basis under GDPR Article 6(1) and breaches of the Article 5(1) principles, indicating that the Commission's enforcement focus concentrates on foundational lawful-basis and principles compliance rather than more specialised violation categories.

Looking beyond Bulgaria's own enforcement activity, Regulation (EU) 2025/2518, which lays down additional procedural rules for cross-border GDPR enforcement, has been enacted but is not yet effective; it will apply from April 2027. This gives Bulgarian controllers and the CPDP a defined preparation period ahead of a materially more harmonised cross-border enforcement procedure across the EU.

Outlook

The rising banking-sector complaint volume, driven by unlawful disclosure to debt collectors, is worth monitoring for whether it produces a dedicated CPDP enforcement action in a future cycle, distinct from the video-surveillance category that currently dominates complaint volume. Separately, the April 2027 application date for Regulation (EU) 2025/2518 sets a clear horizon marker for when Bulgaria's cross-border enforcement procedure will materially change.

Enforcement & Redress

The highest GDPR fine imposed in Bulgaria to date, BGN 5.1 million, was levied against the National Revenue Agency, and this figure remains the benchmark enforcement figure for the jurisdiction. This finding is corroborated across two independent commentary sources and is rated Confirmed.

More recently, a Sofia City Administrative Court decision dated 5 January 2026 reduced the financial penalty against Bulgarian Post EAD, a fine originally connected to its 2022 data-breach case. This is a recent, within-180-day-window development that signals a functioning judicial appeal mechanism materially tempering the CPDP's headline enforcement figures, and it should be read alongside the NRA benchmark fine as evidence that Bulgaria's enforcement regime includes meaningful judicial checks rather than unreviewable regulatory penalties.

Outlook

The item to watch is whether the judicial-moderation pattern seen in the Bulgarian Post EAD case recurs in other pending CPDP enforcement matters, which would further establish judicial review as a structural feature of Bulgaria's GDPR enforcement landscape rather than an isolated outcome.