Bulgaria: CPDP internal regulations amended in light of Whistleblower Protection and Public Disclosure Act
On April 28, 2023, the Rules to amend and supplement the Regulations for the activities of the Commission for Personal Data Protection (CPDP) and its administration were published in the Official Gazette of Bulgaria and entered into force on the same day, following a public consultation launched by the CPDP on March 31, 2023. In particular, the Rules introduce new provisions to reflect the competencies and powers assigned to the CPDP by the Whistleblower Protection and Public Disclosure Act of 2 February 2023 (the Whistleblower Act).
Under the Whistleblower Act, the CPDP acts as the central authority for external whistleblowing reporting and for the protection of persons reporting or publicly disclosing information on violations of Bulgarian law. Further to this, the Rules, among other things, provide for the establishment of an external reporting channel unit, which will assist the CPDP in the exercise of its powers under the Whistleblower Act.