Content type · 31 documents
Enforcement
Regulatory actions, fines, warnings, and enforcement decisions
Country: Bulgaria (31) Clear filter
Filter by Topic Supervisory Authorities3518 Processing Agreement2798 Processing2594 Personal Data2548 Controllers2165 Data Controller1854 Law Enforcement1541 IP Address1278 Security1007 Supervision854 Monitoring523 Consent498
KZLD · €2,556 Municipality of Kyustendil: Insufficient legal basis for data processing Bulgarian Commission for Personal Data Protection (KZLD) fined Municipality of Kyustendil €2,556 on 2025-11-01 for: Insufficient legal basis for data processing. Nov 1, 2025
KZLD · €2,556 Registry Agency of Republic of Bulgaria: Insufficient legal basis for data processing Bulgarian Commission for Personal Data Protection (KZLD) fined Registry Agency of Republic of Bulgaria €2,556 on 2025-03-01 for: Insufficient legal basis for data processing. Mar 1, 2025
KZLD · €770 Secretary of the Central Election Commission Konstantin Ninov: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 770 on Konstantin Ninov, a secretary of the central election commission. The controller forwarded personal data, including voter lists,… Apr 6, 2023
KZLD · €1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient identification methodes, resulting in a customer… Mar 16, 2023
KZLD · €5,100 BULGARIA DPA: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 5,100 on a data controller. An employee of the controller had lodged a complaint with the DPA. The employee had received a ticket for a… Feb 9, 2023
KZLD · €12,800 Political Party: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 12,800 on a political party. In preparation for an upcoming election, the controller submitted a list of supporters to the Central… Jan 26, 2023
KZLD · €1,020 Telecommunications Operator: Non-compliance with general data processing principles The Bulgarian DPA has imposed a fine of EUR 1,020 on a telecommunications operator. The controller did not implement sufficient technical and organisational measures to ensure… Jan 17, 2023
KZLD · €500,000 Bulgarian Post EAD: Insufficient technical and organisational measures to ensure information security The Bulgarian DPA has imposed a fine of EUR 500,000 on Bulgarian Posts EAD. The controller had suffered a hacking attack, during which the attackers managed to access the… May 4, 2022
KZLD · €5,000 Trucking company: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 5,000 on a trucking company. The controller had disclosed personal data of a former employee to third parties without a valid legal… Jan 1, 2022
KZLD · €12,800 Political party: Insufficient legal basis for data processing The Bulgarian DPA has imposed a fine of EUR 12,800 on a political party. Several individuals had filed a complaint with the DPA because their personal data had been added to voter… Jan 1, 2022
KZLD · €380 Bank: Non-compliance with general data processing principles The Bulgarian DPA has fined a bank EUR 380 for the unlawful transfer of personal data to third parties. Oct 26, 2021
KZLD · €2,000 Political Party: Insufficient legal basis for data processing Forging signatures on a voters' list. Apr 14, 2020
KZLD · €2,560 L.E. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca EUR 2,557 was imposed on L.E. EOOD for unlawful processing of personal data of data subject I.S. without the knowing and the consent of the data subject and also… Feb 20, 2020
KZLD · €2,560 T.K. EOOD: Insufficient technical and organisational measures to ensure information security The fine of ca. EUR 2,557 was imposed on T.K. EOOD for unlawful processing of personal data of data subject I.S. by failure to adopt technical and organizational measures to… Feb 20, 2020
KZLD · €5,110 Utility Company: Insufficient legal basis for data processing The fine of EUR ca. 5,113 was imposed on a Bulgarian utility company for unlawful processing of the personal data of the data subject V.V. The personal data of V.V. was unlawfully… Jan 6, 2020
KZLD · €511 Employer: Insufficient fulfilment of data subjects rights The pecuniary sanction of EUR 511 was imposed on an employer for refusal to grant access to the personal data of a data subject who submitted an application for access to his… Oct 28, 2019
KZLD · €5,112 The Ministry of Interior Affairs: Insufficient legal basis for data processing The fine of EUR 5,112 was imposed on the Ministry of Interior Affairs for unlawfully processing the personal data of data subject A.K. The Ministry of Interior sent the personal… Oct 8, 2019
KZLD · €511 B.D.: Insufficient cooperation with supervisory authority The fine of EUR 511 was imposed on B.D. for failure to provide access to information which the Commission for Personal Data Protection needed for performance of its tasks and… Oct 7, 2019
KZLD · €5,113 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… Sep 3, 2019
KZLD · €11,760 Commercial representative of telecommunication service provider: Insufficient legal basis for data processing The pecuniary sanction of EUR 11, 760 was imposed on the commercial representative of telecommunications service provider for unlawful processing of the personal data of a data… Sep 3, 2019
KZLD · €1,022 Telecommunication service provide: Insufficient legal basis for data processing The pecuniary sanctions of EUR 1, 022 and EUR 5, 113 were imposed on a telecommunications service provider and its commercial representative in Bulgaria for unlawful processing of… Sep 3, 2019
KZLD · €28,100 National Revenue Agency: Insufficient legal basis for data processing The pecuniary sanction of EUR 28, 121 was imposed on the National Revenue Agency for unlawful processing of the personal data of data subject G.B.I. The personal data of G.B.I.… Sep 3, 2019
KZLD · €1,121 Private enforcement agent: Insufficient fulfilment of data subjects rights The fine of EUR 1, 121 was imposed on a private enforcement agent for processing of the personal data of data subject through recording by technical means for video surveillance… Sep 3, 2019
KZLD · €511,000 DSK Bank: Insufficient technical and organisational measures to ensure information security Leakage of personal data due to inadequate technical and organisational measures to ensure the protection of information security. Third parties had access to over 23000 credit… Aug 28, 2019
KZLD · €2,600,000 National Revenue Agency: Insufficient technical and organisational measures to ensure information security Leakage of personal data in a hacking attack due to inadequate technical and organisational measures to ensure the protection of information security. It was found that personal… Aug 28, 2019
KZLD · €510 Medical centers: Insufficient legal basis for data processing The sanction of 510 EUR was imposed on each medical center for unlawful processing of the personal data of data subject G.B. by a medical centre for the purpose of changing his… Apr 8, 2019
KZLD · €5,100 A.P. EOOD: Insufficient legal basis for data processing The sanction was imposed on personal data administrator A.P. EOOD for unlawful processing of personal data. The personal data of data subject D.D. was used by A.P. EOOD for… Mar 26, 2019
KZLD · €27,100 Telecommunication service provider: Insufficient legal basis for data processing Repeated registration of prepaid services without the knowledge and consent of the data subject Employees of the telecommunications provider have used personal data and registered… Feb 26, 2019
KZLD · €500 Employer: Insufficient fulfilment of data subjects rights An employee sent a request to his employer for access to personal data concerning him. The request was not answered in time and not in a complete way. Feb 22, 2019
KZLD · €500 Bank: Insufficient legal basis for data processing A bank gained personal data concernign a student wihtout a legal basis. Jan 17, 2019
KZLD · €500 Bank: Insufficient legal basis for data processing A fine of 1000 BGN (or roughly 500 EUR) was imposed on a bank for calling a client for the unresolved bills of his neighbor. This provoked the client to evoke his right to be… Dec 4, 2018