BulgariaKZLD Enforcement and GDPR Article 82
Regulation (EU) 2016/679, Arts. 82-83
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force since 25 May 2018.
An enforcement supervision rule binding public and private bodies.
As of 2 September 2026.
What it requires
- Expect KZLD to have General Data Protection Regulation (GDPR) Article 83 fining power over your processing of personal data of a person in Bulgaria.
- Expect any person in Bulgaria who suffered material or non-material damage from an infringement to have a direct GDPR Article 82 right to compensation, pursued either through a KZLD complaint within 6 months or a direct administrative court claim.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
GDPR Article 83(5) sets the higher administrative-fine tier, up to EUR 20,000,000 or 4% of total worldwide annual turnover, for infringements of the basic processing principles including consent (Arts. 5, 6, 7, 9), the data-subject rights (Arts. 12-22), the Chapter V transfer rules, and non-compliance with a supervisory-authority order under Art. 58(2). The lower Article 83(4) tier, up to EUR 10,000,000 or 2% of turnover, applies instead to the Article 25-39 controller and processor obligations, including the Article 33 and 34 breach-notification duties recorded on the sibling instrument bg-eu-2016-679-33-34 in this file.
- Rule
- Higher of
- As of
- 2 September 2026
- Currency
- EUR
- Fixed cap
- 20,000,000
- Turnover percentage cap
- 4
Who enforces it
Enforcement body
Комисия за защита на личните данни (KZLD, Commission for Personal Data Protection), Bulgaria's supervisory authority under GDPR Article 51.
Enforcement record
KZLD Annual Report 2025 (corrected edition, submitted to the National Assembly 12.03.2026 under PDPA Art. 7(6)), covering the reporting period 1 January 2025 to 31 December 2025. actions_per_year (46) counts the property sanctions/fines (имуществени санкции/глоби) KZLD imposed under GDPR Art. 58(2)(i) read with Art. 83, in complaint-driven proceedings under PDPA Art. 38, during 2025; the report states these individual fines ranged from BGN 500 to BGN 100,000 but does not publish each fine's own amount or a total for this specific 46-count population, so fines_per_year, median_fine, p90_fine and total_fines are not recorded here. The report separately states a BGN 185,000 figure for '9 бр. решения с издадени корективни мерки' (9 decisions with corrective measures issued), but that figure sits in a different section (corrective measures following signals and inspections, not complaints), and a further combined 'Обща стойност на наложените санкции' (total value of imposed sanctions) of BGN 226,000 covering that 185,000 plus separate KANP penal-decree fines of BGN 39,000 and settlement fines of BGN 2,000; none of those three figures is stated to be the total for the same 46-count complaint-driven population, so none is recorded here as this instrument's fines_per_year. KZLD received over 1,700 complaints from individuals in 2025, up from 1,080 in 2024, per the same report; that is complaint volume rather than a fines comparison, so trend is left unrecorded. Counts public KZLD administrative fines only; the report does not separately track private Article 82 compensation claims.
- As of
- 2 September 2026
- Source link
- https://cpdp.bg/wp-content/uploads/2026/04/corrected-Annual-report_2025_CPDP-12.03.2026-%D1%84%D0%B8%D0%BD%D0%B0%D0%BB.pdf
- Actions per year
- 46
What it reaches
Obligation class
Governance
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Комисия за защита на личните данни (KZLD, English: Commission for Personal Data Protection) is Bulgaria's supervisory authority; an Inspectorate with the Supreme Judicial Council holds a parallel, narrower oversight role whose exact scope is not established. General Data Protection Regulation (GDPR) Article 82 arms an individual with a direct private right of action.
Commentary describes a Bulgarian procedural avenue, a complaint to KZLD within 6 months of discovering a violation or a direct administrative court claim, mutually exclusive where Commission proceedings on the same matter are already pending; this is an administrative-enforcement and judicial-review structure rather than a distinct civil damages remedy beyond Article 82, and is recorded here as procedural rather than folded into the private-right-of-action finding's basis.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotprocesses_biometricsprocesses_voice
Read the law
GDPR Arts. 82-83
CMS and DLA Piper commentary (no primary text read)
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.