The right to report wrongdoing and respect for the right to privacy, as well as the protection of personal information, are fundamental values in today’s digital world. In the context of growing geopolitical risks, the digitalisation of governance, and increasing pressure on democratic institutions, the whistleblowers protection and the safeguarding of personal data are becoming a key pillar of the rule of law and economic security.
On 28 January 2026, the Center for the Study of Democracy(CSD), jointly with the Commission for Personal Data Protection (CPDP), organised a roundtable discussion that examined the implementation of European and national rules on the protection of persons reporting irregularities and on personal data protection, with the aim of achieving a balance between security, accountability, and fundamental rights. Representatives of the Ombudsman of the Republic of Bulgaria, the Ministry of Justice, and the organisers- the CPDP and the CSD-took part in the opening of the roundtable.
Dimitar Markov, Director of the CSD Law Program, focused on the importance of the topic of the roundtable and the reasons for its organisation. On the one hand, he highlighted the successful completion of the OPWHI initiative, implemented in the period 2004-2006 jointly by civil society organisations, academic institutions, and state authorities from Bulgaria, Spain, and Italy. On the other hand, he noted the celebration of International Data Protection Day. He welcomed representatives of key institutions, private companies, legal experts, civil society organizations, and journalists, invited to discuss ideas and proposals on how Bulgaria can build more sustainable, coordinated, and trusted mechanisms for reporting and for the protection of reporting persons and personal data protection.
Borislav Bozhinov, Chair of the CPDP, emphasised that personal data protection and the whistleblower protection are core areas of the Commission’s work. He drew attention to the importance of cooperation with non-governmental organisations and the business sector, identified as a key element in the Commission’s new strategy and essential to its success.
Stoyan Lazarov, Deputy Minister of Justice, presented the main amendments to the Act on the Protection of Persons Reporting Violations or Publicly Disclosing Information (Whistleblowing Act), adopted in 2025, aimed at more fully transposing Directive (EU) 2019/1937 of the European Parliament. These include:
- the introduction of protection for a broader range of reporting persons - for example, individuals who are about to start work or who report abuses after the termination of their employment relationship, volunteers, paid and unpaid trainees, and service providers
- the removal of the previous two-year limitation for submitting reports concerning violations committed more than two years earlier
- narrowing the cases in which the law does not apply on the grounds of professional secrecy, with the exceptions now limited solely to the confidentiality of communications and correspondence between lawyers and their clients.
Katya Hristova-Valcheva, Head of the Cabinet of the Ombudsman of the Republic of Bulgaria, emphasised that a specialised Directorate has been established within the Ombudsman institution to conduct on-site audits of the CPDP and examine complaints about violated rights from individuals who have reported irregularities in good faith. She highlighted the need for:
- better coordination between the CPDP as an external channel and the competent authorities;
- more effective protection of whistleblowers, including providing psychological support to those who have become victims of retaliatory measures;
- more precise regulation of access to legal aid, regardless of a person's financial situation.
- drafting Regulations to implement the Whistleblowing Act and improve interaction between the CPDP and other competent authorities, including with regard to corrective measures.
The two-year work under the initiative “Open the Whistle: Protecting Whistleblowers through Transparency, Cooperation, and Open Governance Strategies” was presented by representatives of the Bulgarian partners - Maria Yordanova, Research Fellow at the Center for the Study of Democracy, and Hristo Alaminov, Head of the “International Cooperation and Project Management” Department at the CPDP. They focused on the activities and results dedicated to strengthening the protection of whistleblowers and raising public awareness about reporting irregularities - a topic that is relatively new for Bulgaria.
In the discussion panel “Security and Justice: Protection of Whistleblowers and Personal Data,” the following participants shared their views:
Hristo Konstantinov, Executive Director of APIS Europe LTD, spoke about APIS’s experience in initially providing consultancy services on the implementation of the General Data Protection Regulation (GDPR) and, at present, in offering also consultancy support to private-sector organisations and public institutions in building internal reporting channels, as well as training responsible staff. He presented the development of expert procedures and model documentation within one of the APIS information systems, which help obligated entities acquire the necessary knowledge and competence under the law using ready-made templates.
Alexander Kashumov, Executive Director of the Access to Information Program, examined the relationship between freedom of expression, access to information, and protection when reporting irregularities. He pointed out that the protection of whistleblowers was included in the model law on freedom of information two decades ago. At the same time, he noted that the Bulgarian Access to Public Information Act does not cover this area, as the European standard introduced by a specific Directive requires this regulation to be transposed through a separate law in the Member States. He drew attention to the growing number of civil, criminal, and administrative cases in Bulgaria against public speakers, journalists, and civil activists (SLAPP cases), as well as to the serious threat these cases pose to persons who publicly disclose information about irregularities and to democracy in the country.
Kalin Slavov, Executive Director of the Association Transparency International Bulgaria, presented Transparency International as an international network of organisations that work in each country to promote good governance and reduce corruption. He shared the network’s experience in various research initiatives, information gathering and dissemination, and concrete actions. He explained that through the mechanism of speaking up in the public interest, the system receives information about irregularities and reacts to them in order to preserve the “health” of the democratic organism.
Milena Todorova, Director of the “External Reporting Channel” Directorate at the CPDP, stated that all reports are registered in a specialised records management system, with external access strictly limited. Upon receipt of a report, access is granted only to the employee to whom it is assigned. Before protection is granted, a preliminary analysis is carried out to determine whether the alleged violation falls within the scope of the law and whether there is an affected public interest. To protect the personal data of whistleblowers, during the Commission’s closed sessions the data are reported in anonymised form, with only the Chair having access to the full information. After a decision is taken, reports are forwarded to the competent authorities with personal data redacted within the statutory seven-day period. The Commission informs the whistleblower in writing of the decision taken, describing in the letter the mechanisms for providing protection and the actions taken in the event of retaliatory measures.
In conclusion, the discussion addressed the practical challenges facing the protection of whistleblowers in Bulgaria, the future development of the legal framework, policies, and possible institutional solutions in the context of current national, European, and global trends, as well as the role of independent institutions, business organizations, the media, and civil society.
The debate was also placed in a broader European and international context - from the implementation of the Whistleblower Protection Directive and the General Data Protection Regulation (GDPR), through discussions on economic security and combating the misuse of public funds, to efforts to strengthen democratic resilience.
Despite differing viewpoints, participants expressed shared views on the need to increase awareness and understanding of the importance of personal data and to build a sustainable culture against silence in the face of violations.
