Compass PropertyEffective from: 26.10.2026
On this page Compass Property Burgas EOOD (in Bulgarian: „Компас Пропърти Бургас“ ЕООД) provides information on the conditions and procedure for submitting reports under the Bulgarian Act on the Protection of Persons Reporting or Publicly Disclosing Information on Breaches (ZZLPSPOIN), promulgated in State Gazette No. 11 of 2 February 2023. The articles below are an unofficial English translation of the current text of the Act (last amended in State Gazette No. 38 of 2025); only the Bulgarian text is legally binding. Full text of the Act in Bulgarian: lex.bg.
1. Reporting to the company
Compass Property Burgas EOOD, UIC (EIK) 208963114, registered office and address of management: 7 Todor Mutevski Str., 8900 Nova Zagora; office address: Slaveykov 51, Burgas, Bulgaria.
- In writing — by email to compasspropertyburgas@gmail.com or to the office address, marked "Report under ZZLPSPOIN".
- Orally — by phone on +359 895 46 46 45 or at an in-person meeting arranged at a suitable time.
The report is registered using a form following the template approved by the Commission for Personal Data Protection. No proceedings are instituted on anonymous reports.
2. External reporting
A report may also be submitted to the central authority for external reporting — the Commission for Personal Data Protection: 2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria, www.cpdp.bg.
3. Text of the Act (unofficial translation)
Art. 3
Art. 3. (1) This Act applies to reports or public disclosures of information about:
1. breaches of Bulgarian legislation or of the acts of the European Union listed in the annex to this Act in the field of:
a) public procurement;
b) financial services, products and markets, and prevention of money laundering and terrorist financing;
c) product safety and compliance;
d) transport safety;
e) protection of the environment;
f) radiation protection and nuclear safety;
g) food and feed safety, animal health and welfare;
h) public health;
i) consumer protection;
j) protection of privacy and personal data;
k) security of network and information systems;
2. (supplemented, SG No. 88/2023) breaches affecting the financial interests of the European Union within the meaning of Article 325 of the Treaty on the Functioning of the European Union and as further specified in the relevant Union measures;
3. breaches of the internal market rules within the meaning of Article 26(2) of the Treaty on the Functioning of the European Union, including European Union rules and Bulgarian legislation on competition and State aid;
4. breaches relating to cross-border tax arrangements whose purpose is to obtain a tax advantage that defeats the object or purpose of the applicable corporate tax law;
5. a criminal offence of a general nature that a person under Art. 5 has learned of in connection with their work or in the performance of their official duties.
(2) This Act also applies to reports or public disclosures of information about breaches of Bulgarian legislation in the field of:
1. the rules on payment of public state and municipal receivables due;
2. labour legislation;
3. legislation relating to the performance of civil service.
(3) Where the sectoral acts of the European Union listed in Part II of the annex provide for specific rules on reporting breaches, the rules of those acts or the national provisions transposing them apply. This Act applies to the extent that a matter is not mandatorily regulated by those sectoral acts and national provisions.
(4) (amended, SG No. 88/2023) This Act does not affect the national rules on:
1. the right of workers and employees, and of employers, to consult their representative and trade union organisations and representatives under Art. 7(2) of the Labour Code, and the rules on protection against any unjustified detrimental measures prompted by such consultations;
2. the rules on the independence of the representative bodies of workers, employees and employers, and their right to conclude collective labour agreements.
Art. 5
Art. 5. (1) Protection under this Act is granted to a reporting person from the moment the report is made or the information about a breach is publicly disclosed.
(2) A reporting person within the meaning of this Act is a natural person who reports or publicly discloses information about a breach that has become known to them in their capacity as:
1. (supplemented, SG No. 88/2023) a worker within the meaning of Article 45(1) of the Treaty on the Functioning of the European Union, including a worker, employee, civil servant or any other person performing hired work, regardless of the nature of the work, the method of payment and the source of funding;
2. (supplemented, SG No. 88/2023) a person with self-employed status within the meaning of Article 49 of the Treaty on the Functioning of the European Union, including a person working without an employment relationship and/or practising a liberal profession and/or a craft;
3. (amended, SG No. 88/2023, SG No. 38/2025) a volunteer or a paid or unpaid trainee;
4. a partner, shareholder, sole owner of the capital, member of a management or supervisory body of a commercial company, or member of the audit committee of an undertaking;
5. (supplemented, SG No. 88/2023) a person working for a natural or legal person, its contractors, subcontractors or suppliers;
6. (amended, SG No. 88/2023, SG No. 38/2025) a person whose employment or service relationship is yet to begin, or a person who is about to conclude a contract for the provision of any kind of service, where the information about the breaches was obtained during the recruitment process or other pre-contractual relations;
7. (amended, SG No. 88/2023, SG No. 38/2025) a worker or employee, or any other person under items 1–5, who obtained the information in the course of an employment, service or other relationship in a work-related context that has ended by the time the report or public disclosure is made.
(3) (repealed, SG No. 88/2023)
(4) Protection under this Act is also granted to:
1. (supplemented, SG No. 88/2023) persons who assist the reporting person in the reporting process and whose assistance should be confidential;
2. (amended, SG No. 88/2023) persons connected with the reporting person through work, or relatives of the reporting person, who may suffer retaliation because of the report;
3. legal persons in which the reporting person holds a stake, for which they work or with which they are otherwise connected in a work-related context.
Art. 7
Art. 7. A person who publicly discloses information about a breach is entitled to protection under this Act where they had reasonable grounds to believe that the information about the breach was true at the time of disclosure and that the information falls within the scope of Art. 3, and one of the following conditions is met:
1. the person made a report under the conditions and procedure of this Act, but no appropriate action was taken on the report within the time limits provided for in Sections I and II of Chapter Two;
2. the person has grounds to believe that:
a) (amended, SG No. 88/2023) the breach may constitute an imminent or manifest danger to the public interest, or there is an emergency situation or a risk of irreversible damage;
b) in the case of external reporting, there is a risk of retaliation, or there is a likelihood that the breach will not be effectively addressed because of a risk of concealment or destruction of evidence, suspicion of collusion between the competent authority and the perpetrator of the breach or of the authority's involvement in the breach, or because of other specific circumstances of the case.
Art. 9
Art. 9. (amended, SG No. 38/2025) No proceedings are instituted on anonymous reports.
Art. 12
Art. 12. (1) The obliged entities under this Act are:
1. public-sector employers, with the exception of the municipalities under para. 2;
2. private-sector employers with 50 or more workers or employees;
3. private-sector employers regardless of the number of workers or employees, if their activity falls within the scope of the European Union acts listed in Part I, letter "B" and Part II of the annex to Art. 3(1) and (3).
(2) Municipalities with a population of less than 10,000 or with fewer than 50 workers or employees may share resources for receiving reports of breaches and for follow-up on them, subject to the duty of confidentiality.
(3) (amended, SG No. 88/2023) The obliged entities under para. 1, item 2 with 50 to 249 workers or employees may share resources for receiving reports and for follow-up on them, subject to the requirements of this Act to maintain confidentiality, to provide feedback and to take measures against the reported breach.
(4) The obliged entities shall provide clear and easily accessible information on the conditions and procedure for submitting reports. The information is provided on the obliged entities' websites and in a visible place in their offices and workplaces.
Art. 15
Art. 15. (1) A report is submitted to the employee responsible for handling reports, in writing, including by email, or orally. An oral report may be made by telephone, through other voice messaging systems and, at the request of the reporting person, at an in-person meeting within a suitable time agreed between the parties.
(2) (amended, SG No. 88/2023) To register reports, the obliged entities under Art. 12 use forms following a template approved by the central authority for external reporting, which contains at least the following data:
1. the full name, address and telephone number of the sender, and email address, if any;
2. the name of the person against whom the report is made and their place of work, if the report is made against specific persons and they are known;
3. specific details of a breach or of a real risk of one being committed, the place and period of the breach, if committed, a description of the act or the situation and other circumstances, insofar as they are known to the reporting person;
4. the date of the report;
5. signature, electronic signature or other identification of the sender.
(3) (amended, SG No. 38/2025) A written report is submitted by the sender by completing the form under para. 2. An oral report is documented by the employee responsible for handling reports by completing a form, which they offer the reporting person to check, correct and approve by signing it. With the explicit consent of the reporting person, an oral report made by telephone, another voice messaging system or at an in-person meeting may also be documented by a recording on a durable medium that allows its retrieval.
(4) Any kind of information source supporting the statements in the report and/or references to documents may be attached to the report, including details of persons who could confirm the information reported or provide additional information.
(5) If the report does not meet the requirements of para. 1, the reporting person is sent a notice to remedy the irregularities within 7 days of receipt of the report. If the irregularities are not remedied within that period, the report and its attachments are returned to the reporting person.
(6) Every report is checked for credibility. Reports that fall outside the scope of this Act and whose content gives no grounds to consider them plausible are not examined. Reports containing manifestly false or misleading statements of fact are returned with an instruction to the sender to correct the statements and on the liability they bear for false accusation.
Art. 19
Art. 19. (1) The central authority for external reporting and for the protection of the persons granted such protection within the meaning of this Act is the Commission for Personal Data Protection, hereinafter "the Commission".
(2) In implementing this Act, the Commission:
1. organises the receipt of reports and refers them to the competent authorities for verification and follow-up;
2. (amended, SG No. 88/2023) approves forms for receiving reports; coordinates and supervises the handling of reports by the competent authorities under Art. 20 and by all authorities and organisations that receive or work with such reports;
3. provides methodological guidance to the obliged entities under Art. 12(1), trains their employees responsible for handling reports under this Act, and adopts an ordinance on keeping the register under Art. 18(4) and on forwarding internal reports to it;
4. maintains a register of reports, analyses and summarises the practice of handling them, and provides the European Commission with the necessary statistical data;
5. exercises the other powers assigned to it under this Act and ensures the protection of persons who report or publicly disclose information about breaches, including by applying the administrative measures provided for in this Act;
6. (new, SG No. 84/2023, in force from 06.10.2023) issues, jointly with other authorities, instructions for cooperation in ensuring the protection of reporting persons, where provided for by law.
(3) Reports relating to unlawful processing of personal data within the meaning of Regulation (EU) 2016/679, the Personal Data Protection Act and other special laws or acts of the European Union are examined by the Commission under the general procedure provided for in those laws and acts.