An external audit by the Bulgarian Ombudsman has found serious flaws in the implementation of the Whistleblower Protection Act by the central authority, the Commission for Personal Data Protection.
The Ombudsman of Bulgaria has published the second annual external audit of the Commission for Personal Data Protection (CPDP), the body responsible for whistleblower protection. The findings reveal serious issues with identity protection, legal clarity, support for whistleblowers, and procedural delays – raising doubts about the effectiveness of the current system in meeting EU requirements.
Key Highlights:
- Identity protection is not automatic: The CPDP only protects whistleblowers’ identities upon explicit request, contrary to the whistleblowing law, and EU Directive standards.
- Corrective measures undefined: The law lacks specificity, leading to hesitation and delays from responsible authorities.
- Limited whistleblower support: CPDP only provides standard documents that fail to explain how to access protection or support.
- Legal aid barriers: Whistleblowers are excluded from categories eligible for free legal aid, creating further obstacles.
- Delays and administrative burden: Poor coordination, reporting delays, and procedural hurdles risk missing statutory deadlines.
Expert Commentary: In their paper Whistleblower Protection in Bulgaria: Key Issues and Urgent Changes Needed, anti-corruption NGO Transparency International Bulgaria argues that without urgent legislative and administrative reform, whistleblower protection risks remaining a formality rather than an effective safeguard. The paper highlights findings from the Ombudsman that illustrate the gap between current practice and the requirements of the EU Directive.
Background & Context: Bulgaria adopted its Whistleblower Protection Act (‘Закон за защита на лицата, подаващи сигнали или публично оповестяващи информация за нарушения’) in 2023, transposing EU Directive
2019/1937. The CPDP was designated as the central body for external reporting, and the Ombudsman was empowered to audit its performance. This second audit reveals persistent legal and operational failings that jeopardise effective protection.
- [Unofficial English Summary by TI Bulgaria – April 2025]
- For the full Ombudsman report (in Bulgarian), click here.
- For the Act on the Protection of Persons who Report Breaches, click here.