Reporting Breaches via the BDIF Internal Channel

Reporting breaches via the BDIF internal channel

The Act on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches (APPRPDIB), in force as of 4 May 2023, provides protection to individuals in both the public and private sectors who report or publicly disclose information on breaches of Bulgarian legislation or of acts of the European Union that threaten or harm the public interest, which has become known to them in the course of, or in connection with, the performance of their employment or official duties, or in another work-related context, so that they may feel effectively protected and any potential retaliation may be prevented.

The APPRPDIB does not apply to the examination of complaints, reports or other requests, regardless of how they are titled, through which solely the protection of personal rights is sought (where there is a personal and direct legal interest), without any indication of an affected public interest. Under the terms and conditions of the APPRPDIB, complaints labelled as reports that concern interpersonal relations cannot be examined, irrespective of whether a work-related context exists or not.

The Act establishes the procedures and conditions for submitting and reviewing such reports on breaches and introduces the requirement to establish internal and external reporting channels.

• “Internal reporting” to obliged entities under Article 12 of the APPRPDIB means the oral or written communication of information on breaches within a given legal entity in the private or public sector.
• “External reporting” to the Commission for Personal Data Protection (CPDP) means the oral or written communication of information on breaches to the competent authorities in accordance with the APPRPDIB.

With a view to enabling the prompt prevention of a breach or the remedying of its consequences, the APPRPDIB encourages the prioritised use of the internal reporting channel.

How to submit a report on a breach via the BDIF internal channel

In accordance with the requirements of the APPRPDIB, reports submitted via the internal channel shall be addressed to the employee responsible for receiving, registering and reviewing reports, either in writing or orally. Submission by email is also considered a written report. Oral reporting may be made by telephone, via other voice messaging systems, or, at the request of the reporting person, through a face-to-face meeting arranged within a mutually convenient timeframe.

Standardised forms approved by the national authority for external reporting – the Commission for Personal Data Protection (CPDP) – are used for the registration of reports.

A written report may be submitted by completing the form approved by the CPDP. An oral report shall be documented by the employee responsible for receiving, registering and reviewing reports by completing the same form and offering the reporting person the opportunity to sign it, should they wish to do so. With the explicit consent of the reporting person, an oral report submitted via a telephone line, other voice messaging system or during a personal meeting may also be documented through a recording on a durable medium enabling its retrieval.

Any type of information supporting the statements contained in the report may be attached, including references to documents and the provision of details of persons who may confirm the reported information or provide additional information.

A report may not meet the statutory requirements. In such cases, the reporting person will be notified to remedy any irregularities within seven days of receipt of the report. If the irregularities are not remedied, the report and its attachments will be returned to the reporting person.

Each report is verified as to its credibility. Reports that do not fall within the scope of the APPRPDIB and whose content does not provide grounds to consider them plausible shall not be examined. Reports containing manifestly false or misleading statements of fact shall be returned with instructions to the sender to correct the statements and with information regarding the liability for false reporting.

Within the statutory period of seven days following receipt of a report on a breach, the reporting person shall receive confirmation of receipt together with information on the Unique Identification Number (UIN) and the date of registration of the report. All subsequent information or communication relating to the report shall be attached to this UIN. Any new or previously unspecified information relating to the report may be submitted additionally by the reporting person, provided that the UIN assigned to the report is indicated upon submission.

You may submit a report concerning breaches of Bulgarian legislation or of acts of the European Union via the BDIF internal channel, either in writing or orally, in person at the registered address of the BDIF:

Sofia 1606
27 Vladaiska Street

You may also submit a written report by email to the BDIF employee responsible for receiving, registering and reviewing reports:

e-mail: signali@dif.bg

or by telephone at the following numbers: +359 2 953 1217 and +359 2 953 1318, after which you may request to be connected with the BDIF employee responsible for receiving, registering and reviewing reports on breaches.