Online safety in Bulgaria: the EU Digital Services Act (2026)

Bulgaria's Parliament adopted comprehensive amendments to the Cybersecurity Act transposing Directive (EU) 2022/2555 (NIS2), expanding covered sectors from 8 to 18, introducing 'essential' vs 'important' entity tiers, and raising maximum fines to €10 million / 2% of global turnover for essential entities. The law was promulgated in the State Gazette on 13 February 2026, over 15 months after the EU's 17 October 2024 deadline.

Amendments to the Electronic Communications Act entered into force, formally empowering the Communications Regulation Commission (CRC) as Bulgaria's Digital Services Coordinator with supervisory and penalty powers under the EU Digital Services Act, and designating the Council for Electronic Media as competent authority for video-sharing services. The legislation closed the gap that had triggered EU infringement proceedings in December 2024.

The Commission sent a letter of formal notice (INFR(2024)2241) to Bulgaria for failing to legislatively empower a Digital Services Coordinator and failing to set applicable penalty rules by the 17 February 2024 DSA deadline, initiating formal infringement proceedings against Bulgaria alongside Belgium, Spain, the Netherlands, and Poland.

By Decision No. 405/13.6.2024, Bulgaria's Council of Ministers administratively designated the Communications Regulation Commission as the national Digital Services Coordinator under the DSA, an interim step that lacked the necessary legislative basis, leaving enforcement powers ungranted and prompting the Commission's subsequent infringement action six months later.

The pro-Russian hacktivist group Killnet launched a large-scale distributed denial-of-service attack that temporarily took offline the websites of Bulgaria's Presidency, Defence Ministry, Interior Ministry, Justice Ministry, and Constitutional Court, framing it as retaliation for alleged Bulgarian support of Ukraine. The incident exposed gaps in state cyber-resilience and reinforced political pressure to accelerate NIS2 transposition.

The Commission for Personal Data Protection (CPDP) imposed a BGN 5.1 million (~€2.6 million) fine on the National Revenue Agency for failing to implement adequate technical and organizational security measures following Bulgaria's largest-ever personal data breach. It was one of the earliest and largest GDPR enforcement actions in Central and Eastern Europe.

A hacker breached the National Revenue Agency and extracted approximately 11 GB of tax, insurance, and personal data belonging to over five million Bulgarian citizens, nearly every working adult in the country, and leaked a portion to local media. The breach was the largest in Bulgarian history and catalysed the country's first major GDPR enforcement action.

Amendments to the Personal Data Protection Act (State Gazette No. 17, 26 February 2019) adapted the 2002 foundational Act to the EU General Data Protection Regulation and simultaneously transposed Directive (EU) 2016/680 on law-enforcement data processing, completing Bulgaria's formal GDPR alignment.

Bulgaria's Parliament enacted the Cybersecurity Act, transposing EU Directive 2016/1148 (NIS) and establishing the national cybersecurity governance architecture: CERT Bulgaria, sector-specific CSIRTs, and mandatory security obligations for operators of essential services and digital service providers. The Ministry of Electronic Governance was designated the national competent authority.

On joining the EU, Bulgaria became bound by the entire EU digital regulatory acquis, including the e-Commerce Directive (2000/31/EC), the Electronic Communications Framework Directives, and EU data-protection rules. The Communications Regulation Commission was established as the principal regulator under an Electronic Communications Act aligned with EU standards, creating the foundational supervisory infrastructure for online safety.