Amendments in 2025 to the Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act
In May 2025, significant amendments to the Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act entered into force. These changes expand the protection of whistleblowers and tighten obligations for employers. Below is a summary of the key developments that managers and employers should consider to ensure compliance and strengthen trust within their organizations.
Key Amendments in 2025
- No Time Limit for Reports:
The previous restriction that prevented review of reports concerning breaches committed more than two years ago has been removed. This means that the submission of breach reports is no longer time-barred, including older cases. As for anonymous reports – their submission still constitutes a barrier to initiating proceedings. - Broader Scope of Protected Persons:
The Act now explicitly extends protection to more categories of reporting persons. It includes volunteers and interns (whether paid or unpaid), as well as individuals who are about to start employment or enter into a service contract – if they obtained information about breaches during recruitment or other pre-contractual interactions. This necessitates increased caution during recruitment and negotiation processes, as unclear or bad-faith practices at this stage may lead to whistleblowing and cause legal and reputational risks for the organization. Protection also extends to employees, workers, or other persons referred to in the Act who obtained the information in the context of an employment, service, or other work-related relationship that has since been terminated at the time of reporting or public disclosure. - Mandatory Internal Reporting Channel for Each Organization:
Every private sector employer with 50 or more employees, or regardless of staff size if operating in certain specific sectors, is now required to establish an individual internal reporting channel, as the option to use a shared channel within an economic group has been eliminated. Even companies within the same group must each maintain a separate reporting channel that complies with the legal requirements. The goal is to ensure independence and confidentiality in the handling of reports within each organization. - Recording of Oral Reports (with Consent):
A new provision allows an oral report (e.g., made by phone or in person) to be recorded on a durable medium, provided the reporting person consents. The previous requirement for the reporting person to sign a written protocol when submitting an oral report has been abolished – the form completed by the officer responsible for handling the report is presented for review and approval, and is signed only if the reporting person chooses to do so. This facilitates the reporting process and ensures accurate documentation of reports. - Sanctions for Non-Compliance:
The Act now introduces financial sanctions for legal entities (in addition to sanctioning responsible officials), which may be fined from BGN 1,000 to BGN 7,000 for obstructing the submission of a report, unjustifiably delaying its review, or breaching confidentiality. These penalties are intended to encourage strict implementation of the new requirements by organizations.
Which Employers Must Comply with the Act?
All private employers with 50 or more employees, as well as all public sector organizations (government bodies, designated municipalities, etc.) are obligated to comply with the Act. This means they must establish an internal reporting channel and procedures for handling reports. Private companies with fewer than 50 employees are not directly bound unless they operate in certain sensitive sectors. However, once a private-sector organization reaches the threshold of 50 employees, it automatically becomes subject to the Act’s requirements. In the private sector, the deadline for implementation of reporting channels has already passed. For companies with 50–249 employees, the law became applicable from 17 December 2023. Therefore, by 2025, every employer with 50+ staff should already have a functioning internal reporting and processing system in place. The public sector has been covered from the outset.
Risks of Non-Compliance
Failure to comply with the Act poses serious risks for employers. First and foremost, organizations may face substantial fines for not providing a reporting channel or for violating the protection of whistleblowers. In addition to financial penalties, there is also a reputational risk: an organization known for ignoring or covering up reports may lose the trust of its employees and partners. A lack of an adequate internal reporting system can lead to regulatory intervention or legal disputes.
Conversely, organizations that proactively implement the law earn greater trust. By handling reports in a timely manner and protecting good-faith whistleblowers, leadership demonstrates a commitment to ethics and transparency. This not only prevents penalties but also improves the organizational culture.
Practical Advice for Employers
Employers are advised to review and update their internal policies to align with the new amendments. If you still lack an internal reporting channel – now is the time to build one. Ensure employees are informed about how to submit a report and that they feel safe doing so. Appoint or authorize a competent person or unit to receive and investigate reports under strict confidentiality. If needed, consult an experienced lawyer to help develop procedures, train staff, and bring the organization into full compliance with the law.
Conclusion
The May 2025 amendments to the Protection of Persons Reporting or Publicly Disclosing Information on Breaches Act serve as a call to action for all employers. Having an effective reporting system should not be seen as a burden, but as an investment in a more transparent and resilient business environment. By taking proactive measures today, managers can avoid problems tomorrow – protecting both their organization and the employees who dare to speak up about misconduct.
Disclaimer: The analysis and information provided in this article are for general informational purposes only and should not be considered legal advice. If you require legal assistance in relation to a specific case, we recommend consulting a competent attorney. The author assumes no liability for actions taken based on the content of this publication.