Order report
BULLETIN №081Last updated · 26 Jul 2026

Fine Tracker.

A public register of regulatory fines issued under EU compliance directives. Updated as decisions are published by national supervisory authorities.

5,273 entries

Total fines
€8.6bn
Decisions
5,273
Jurisdictions
33
Regulators
74
Avg monthly
€162.7m
YoY volume
-20.7%
Country
Type
Date range
ImposedCompanyCountryAuthorityTypeAmount↗
26 Oct 2021ЧСИ2The Commission fined the private bailiff ЧСИ2 for unlawfully processing personal data by accessing bank account information after the enforcement proceeding had ended. The authority found a breach of the purpose limitation principle under Article 5 GDPR.BGCPDPGDPR€383↗
03 Sept 2019ЧСИThe CPDP fined a private bailiff (ЧСИ) for failing to provide a data subject with access to personal data collected through video surveillance. The authority found a breach of Article 12 GDPR.BGCPDPGDPR€1,790↗
17 Jan 2019Учебно заведениеThe school was fined 1,000 BGN by the CPDP for unlawfully processing students' personal data. It shared the data with a financial institution without proper consent, which breached GDPR requirements.BGCPDPGDPR€511↗
24 Aug 2021Топлофикация София ЕАДThe Bulgarian data protection authority fined Toplofikatsia Sofia EAD 2,000 BGN for unlawful processing of personal data caused by a name coincidence. The error led to incorrect legal actions being taken against an individual.BGCPDPGDPR€1,023↗
26 Feb 2019телекомуникационен операторThe telecommunications operator was fined BGN 53,000 by the CPDP for processing personal data without consent. The case involved changing a subscription plan to a prepaid service without the data subject's knowledge or agreement.BGCPDPGDPR€27,099↗
27 Sept 2021Сиела Норма АДThe CPDP found that Сиела Норма АД violated the GDPR by inaccurately processing personal data. The error led to an individual being misidentified as a liquidator of companies, and a fine of 5,000 BGN was imposed.BGCPDPGDPR€2,557↗
05 May 2022РТК ЕООДThe company processed personal data without a lawful basis by including an individual's data in a public register without a valid contract or consent. The authority found this to be a breach of data protection principles and imposed a fine.BGCPDPGDPR€5,113↗
11 Feb 2021Политическа партия „Д.П.Б.“Political party “D.P.B.” was fined 1,000 BGN by CPDP for processing personal data without the consent of the data subjects. The breach occurred during the registration of election commission members and violated Article 6 GDPR.BGCPDPGDPR€511↗
12 Feb 2018Политическа партия „Движение презареди България“The political party Movement Reload Bulgaria was fined 10,000 BGN by the CPDP for processing personal data without consent. The breach occurred during the registration of individuals as election commission members and violated the Bulgarian Personal Data Protection Act.BGCPDPGDPR€5,113↗
26 Jan 2023Политическа партия ******The political party unlawfully processed personal data by including individuals in a list supporting its election registration without their consent. The authority found breaches of GDPR Articles 5, 6, and 24.BGCPDPGDPR€7,823↗
23 Jul 2019община К.The Municipality of K. unlawfully processed the complainant’s personal data by sharing it with third parties without consent. The authority found a GDPR breach and imposed a 500 BGN fine.BGCPDPGDPR€256↗
24 Jul 2019НОИThe National Social Security Institute (НОИ) was fined for failing to implement adequate technical and organizational measures to prevent employees from accessing personal data without authorization. The authority found this to be a breach of GDPR Article 25.BGCPDPGDPR€2,557↗
03 Sept 2019Национална агенция за приходитеThe National Revenue Agency was fined 55,000 BGN for processing personal data without a lawful basis. The authority found that data were collected and used in enforcement proceedings in breach of Article 6 GDPR.BGCPDPGDPR€28,122↗
08 Oct 2019Министър на вътрешните работиThe Ministry of Interior was fined for unlawfully processing and sharing the personal data of a Finnish citizen with Togo authorities without a legal basis. The authority found a breach of GDPR principles on lawful processing and data disclosure.BGCPDPGDPR€5,113↗
06 Apr 2023К. Л. НK. L. N was fined for unlawfully processing voters' personal data. The case involved forwarding an email containing scanned voting lists to a personal email address, in breach of GDPR Article 6.BGCPDPGDPR€767↗
06 Jan 2020дружество за комунални услугиThe utility company processed the complainant’s personal data without a lawful basis by sharing it with a private bailiff for enforcement proceedings. CPDP imposed a fine of 10,000 BGN for breaching Article 6 GDPR.BGCPDPGDPR€5,113↗
03 Sept 2019А.Т.The CPDP imposed a fine of 23,000 BGN on A.T. for processing personal data without consent, in breach of Article 6 GDPR. The case concerned the creation of financial obligations for the complainant without a valid contract.BGCPDPGDPR€11,760↗
30 Jul 2018А.С.К. УМБАЛ ЕООДThe CPDP found that “А.С.К. УМБАЛ ЕООD” unlawfully processed personal data by providing it to “МБАЛ-В. ЕООD” without consent. This breached data protection rules and resulted in a fine of BGN 1,000.BGCPDPGDPR€511↗
26 Mar 2019А.Р. ЕООДThe CPDP imposed a 10,000 BGN fine on А.Р. ЕООД for processing personal data without consent. The case also involved registering an employment contract for an imprisoned individual, which breached Article 6 GDPR.BGCPDPGDPR€5,113↗
07 Oct 2019Анонимизирано (CPDP решение-по-жалба-с-рег-№-ппн-01-657-08-0)The Bulgarian data protection authority, CPDP, fined an individual, V.M., BGN 1,000. The sanction concerned failure to provide access to information requested by the authority in connection with a complaint about unlawful dissemination of personal data.BGCPDPGDPR€511↗