In 2023, the Law on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches was introduced into Bulgarian legislation. The Law transposes the requirements of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law.
The Law was promulgated in the State Gazette, Issue No. 11 of 2 February 2023, and entered into force on 4 May 2023. Its main objective is to ensure effective protection for persons who report breaches affecting the public interest, as well as to establish a clear and secure procedure for the submission, handling and follow-up of such reports.
 
In 2025, amendments and supplements to the Law were promulgated in the State Gazette, Issue No. 38. These changes further refine certain rules for the application of the Law and extend protection to additional categories of persons. Detailed information on these amendments is available in a separate publication on the website.
 
Scope of the Law
The Law applies to reports or public disclosures of information concerning breaches of Bulgarian legislation or acts of the European Union, including in the following areas:

• public procurement;
• financial services, products and markets, as well as the prevention of money laundering and terrorist financing;
• product safety and compliance;
• transport safety;
• environmental protection;
• radiation protection and nuclear safety;
• food and feed safety, animal health and animal welfare;
• public health;
• consumer protection;
• protection of privacy and personal data;
• security of networks and information systems.

The Law also covers:

• breaches affecting the financial interests of the European Union;
• breaches of the rules of the EU internal market, including competition and state aid rules;
• breaches related to cross-border tax arrangements;
• criminal offences of a general nature, where the reporting person became aware of them in connection with their work.

In addition, the Law applies to reports concerning breaches of Bulgarian legislation in the field of:

• labour law;
• payment of due public state and municipal receivables;
• legislation related to the performance of public service.

 
Entities Subject to Obligations under the Law
The following entities are required to establish internal reporting channels:

• employers in the public sector, with the exception of municipalities with a population of fewer than 10,000 inhabitants or fewer than 50 employees;
• employers in the private sector with 50 or more employees;
• employers in the private sector, regardless of the number of employees, where their activities fall within the scope of specific acts of the European Union.

Organisations with between 50 and 249 employees may, under certain conditions, use a shared internal reporting channel, in compliance with the requirements of the Law.
 
Key Obligations of Employers
The Law introduces specific obligations for the obligated entities, including:

• developing and implementing internal rules for the submission and handling of reports;
• designating one or more persons responsible for receiving and processing reports, or outsourcing these functions to an external service provider;
• ensuring clear and easily accessible information regarding the reporting procedures;
• establishing and maintaining a non-public register of reports;
• providing the necessary information and statistical data to the competent national authority;
• periodically reviewing and updating internal rules and practices related to the implementation of the Law.

 
Protection of Reporting Persons
The Law provides broad protection for persons who report breaches in good faith. Any form of retaliation is expressly prohibited, including disciplinary sanctions, dismissal, demotion, harassment, or any other actions placing the reporting person at a disadvantage.
The central authority for external reporting and for the protection of persons under the Law is the Commission for Personal Data Protection (CPDP).
 
How CONSEJO Can Assist
The CONSEJO team provides professional consultancy services related to the application of the Law, including:

• establishment and implementation of internal reporting channels;
• development of internal rules and registers;
• integration of the Law’s requirements into quality management systems and information security frameworks;
• provision of a Data Protection Officer, who may also perform the functions assigned under the Law.

Law on the Protection of Persons Reporting Breaches