The National Assembly adopted a new Law on protection of persons reporting or publicly disclosing information on breaches (the “Whistleblowing Law”) which transposes the requirements of Directive (EU) 2019/1937 on the protection of persons who report breaches of Union law.

The new Whistleblowing Law aims to ensure protection of persons in the public and private sector who report or publicly disclose information on breaches of Bulgarian legislation or acts of the European Union acquired in a work-related context.

The Whistleblowing Law is published in State Gazette, Issue No. 11 dated 3 February 2023 and is effective as of 4 May 2023, except the provisions establishing obligations for the employers in the private sector having between 50 and 249 workers or employees which shall apply from 17 December 2023.

Below is a summary of the more important aspects of the new Whistleblowing Law:

Who are the obligated persons under the Whistleblowing Law?

The obligated persons under the Whistleblowing Law are:

  • Employers in the public sector, except municipalities with a population of less than 10,000 people or less than 50 workers or employees.
  • Employers in the private sector with 50 or more workers or employees.
  • Employers in the private sector, regardless of the number of workers or employees, if their activity falls within the scope of certain well-described acts of the European Union (e.g., financial and insurance sector, other public interest entities, obligated persons under the Law on Measures Against Money Laundering, etc.).

What obligations does the Whistleblowing Law impose?

Each employer subject to the Whistleblowing Law shall:

  • Establish an internal reporting channel in compliance with the requirements specified under the law.
  • Adopt rules for internal reporting and follow-up on the reports received, subject to regular review and update (at least once every three years).
  • Appoint one or more employees responsible for handling reports (this may be the data protection officer, and if there is no obligation to appoint a data protection officer, another employee is designated to handle reports).
  • Provide clear and easily accessible information regarding the procedures for reporting.
  • Create and maintain a record of the reports received and adopt internal act for its keeping in compliance with a regulation adopted by the national body for external whistleblowing.
  • Submit regularly the necessary statistical information to the national body for external whistleblowing in accordance with the procedure established by it.
  • Fulfil the other obligations provided for under the Whistleblowing Law.

Legal entities in the private sector with a total number of 50 to 249 workers or employees may use a common channel for internal reporting by designating one person or separate unit responsible for handling reports. This exception does not apply to employers in the private sector whose activity falls within the scope of certain well-described acts of the European Union as per above.

Legal entities in the private sector may assign the functions of receiving and registering reports of breaches to another natural or legal person outside their structure, subject to compliance with the requirements of the law, and may use an internal reporting channel created by the economic group to which they belong, if the channel meets the requirements of the Whistleblowing Law.

What kind of breaches can be reported under the Whistleblowing Law?

The Whistleblowing Law applies to reports or public disclosure of information about:

  • Breaches of Bulgarian legislation or acts of the European Union in certain areas, including, but not limited to public procurements, finance services, prevention of money laundering and terrorist financing, product safety and compliance, transport safety, protection of the environment, food and feed safety, animal health and welfare, public health, consumer protection, protection of privacy and personal data, and security of network and information systems.
  • Breaches affecting the financial interests of the European Union and breaches relating to the internal market, including breaches of the European Union competition and State aid rules.
  • Breaches relating to cross-border tax arrangements the purpose of which is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law.
  • Committed crimes of a general nature, of which the whistleblower has become aware in a work-related context.
  • Breaches of the rules for payment of due public state and municipal receivables, breaches of the labour legislation or of the legislation related to the performance of public service.

Who is protected under the Whistleblowing Law?

The Whistleblowing Law provides for protection to the whistleblower being a natural person who has reported or publicly disclosed information on a breach which was acquired in a work-related context, including in the capacity of workers, employees, public officials, self-employed, trainees, persons working under the supervision and direction of contractors, subcontractors and suppliers, job applicants, shareholders, board members, etc.

The protection measures also apply to facilitators, third persons who are connected with the reporting persons, such as colleagues or relatives, and legal entities that the reporting persons own, work for or are otherwise connected with in a work-related context.

How are the whistleblowers protected?

The Whistleblowing Law prohibits any form of retaliation against the whistleblowers and the other protected persons, including threats of retaliation and attempts of retaliation.

The forms of the retaliation may include, but are not limited to dismissal, demotion or withholding of promotion, change of location of place of work, reduction in wages, change in working hours, a negative performance assessment or employment reference, imposition of any disciplinary measure, discrimination, early termination of a contract, harm, including to the person’s reputation, or financial loss, including loss of business and loss of income, cancellation of a licence or permit.

In case of breach of this prohibition the whistleblower has the right to compensation for any material and non-material damages suffered. Any damages caused to the whistleblower in connection with his/her report or publicly disclosed information are considered to have been caused intentionally unless proven otherwise.

What are the consequences of non-compliance?

The Whistleblowing Law provides for various sanctions for breaching the obligations under it which, depending on the type of the breach, vary from BGN 400 (appr. EUR 200) to BGN 20,000 (appr. EUR 10,200) for legal entities. For repeated breaches of the obligations to create an internal reporting channel and to regularly review and update the internal rules adopted in this regard, larger amounts of sanctions are provided, namely from BGN 10,000 (appr. EUR 5,100) to BGN 30,000 (appr. EUR 15,300) for legal entities.

The Whistleblowing Law also provides for a fine from BGN 3,000 (appr. EUR 1,500) to BGN 7,000 (appr. EUR 3,500) for persons where it is established that they knowingly reported or publicly disclosed false information.

Which is the central authority for external reporting?

The central national authority for external reporting and for protection of the persons to whom such protection is provided under the Whistleblowing Law is the Commission for Personal Data Protection (the “Commission”).

In addition, the Commission gives methodological instructions to the obligated entities under the Whistleblowing Law, adopts forms and а regulation as required by the said law and performs the other powers attributed to it by virtue of the law, including the competent Commission’s officials are responsible for drawing up acts establishing breaches of the Whistleblowing Law and for issuing penal decrees with respect to such breaches.

How can we help?

The KPMG team remains at your disposal should you have any questions or need assistance regarding the interpretation and application of the Whistleblowing Law.