BulgariaKZLD Enforcement and GDPR Article 82
Regulation (EU) 2016/679, Arts. 82-83
In force since .
An enforcement supervision rule binding public and private bodies.
- Obligation class
- Governance
- Audit expectation
- none
What it requires
- Compensate any person who suffered material or non-material damage from your infringement, as controller or processor, under General Data Protection Regulation (GDPR) Article 82.
These lines are LexLint's reading of the law's text. Also read by: Case C-340/21 VB v Natsionalna agentsia za prihodite, judgment of the Court of Justice of (Third Chamber) (recorded ).
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements of the basic processing principles including consent (Arts. 5, 6, 7, 9), the data-subject rights (Arts. 12-22), the Chapter V transfer rules, and non-compliance with a supervisory-authority order under Art. 58(2). The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25-39 controller and processor obligations, including the Article 33 and 34 breach-notification duties recorded on the sibling instrument bg-eu-2016-679-33-34 in this file. The Personal Data Protection Act ties fines for infringing its own Articles 12a(1), 25g, 25e(2), 25zh, 25z, 25i, 25k and 25n to the GDPR Article 83(5) amounts (Article 85(2)), and caps every other infringement of the Act at BGN 5,000, doubled for a repeat infringement (Article 86).
- Rule
- Higher of
- As of
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Комисия за защита на личните данни (KZLD, Commission for Personal Data Protection), Bulgaria's supervisory authority under GDPR Article 51.
Enforcement record
KZLD Annual Report 2025 (corrected edition, submitted to the National Assembly 12.03.2026 under PDPA Art. 7(6)), covering the reporting period to . The 46 actions counted are the property sanctions/fines (имуществени санкции/глоби) KZLD imposed under GDPR Art. 58(2)(i) read with Art. 83, in complaint-driven proceedings under PDPA Art. 38, during 2025; the report states these individual fines ranged from BGN 500 to BGN 100,000 but does not publish each fine's own amount or a total for this specific 46-count population. The report separately states a BGN 185,000 figure for '9 бр. решения с издадени корективни мерки' (9 decisions with corrective measures issued), but that figure sits in a different section (corrective measures following signals and inspections, not complaints), and a further combined 'Обща стойност на наложените санкции' (total value of imposed sanctions) of BGN 226,000 covering that 185,000 plus separate KANP penal-decree fines of BGN 39,000 and settlement fines of BGN 2,000; none of those three figures is stated to be the total for the same 46-count complaint-driven population. KZLD received over 1,700 complaints from individuals in 2025, up from 1,080 in 2024, per the same report; that is complaint volume rather than a fines comparison. Counts public KZLD administrative fines only; the report does not separately track private Article 82 compensation claims.
- As of
- Source link
- https://cpdp.bg/wp-content/uploads/2026/04/corrected-Annual-report_2025_CPDP-12.03.2026-%D1%84%D0%B8%D0%BD%D0%B0%D0%BB.pdf
- Actions per year
- 46
Settledness
- As of
- Case link
- https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0340
- Case citation
- Case C-340/21 VB v Natsionalna agentsia za prihodite, judgment of the Court of Justice of (Third Chamber)
- Open questions
- Does the bar in Article 39(4) of the Personal Data Protection Act on going to court while proceedings before the Commission for Personal Data Protection on the same violation are pending apply to a claim for compensation under Article 82 of Regulation (EU) 2016/679?
What it makes you log
Logging duty
Article 82 gives a right to compensation for damage, and Articles 17, 38 and 39 of the Personal Data Protection Act set who supervises and how a complaint or a court claim is brought. None of them requires a log or a record.
- Kind
- None
- As of
What this law does
Комисия за защита на личните данни (KZLD, English: Commission for Personal Data Protection) is Bulgaria's supervisory authority; the Inspectorate with the Supreme Judicial Council supervises compliance when the courts, the prosecution and the investigating bodies process personal data in their judicial functions (Article 17(1)). General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.
Under Article 38(1) of the Act a data subject may refer a violation to KZLD within 6 months of learning of it and no later than two years after it was committed. Under Article 39 a data subject may instead challenge the acts of a controller or processor before the court under the Administrative Procedure Code and claim compensation in those proceedings. A data subject cannot go to court while proceedings on the same violation are pending before KZLD.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .