Penalties under the Cybersecurity Act

The law sets a pecuniary penalty for failure to comply with the obligations under Art. 22 and Art. 23. The amount depends on whether the entity is essential or important, and is determined as the higher of two values: a fixed upper limit or a percentage of turnover.

A particularity of the Bulgarian transposition is that, in addition to an upper limit, minimum amounts are also set. This means that even for a small organisation the penalty has a lower bound, rather than being reduced to a token sum.

The penalty is not the only consequence. A separate personal fine is provided for managers in the event of an infringement of the obligations under Art. 21, as well as a penalty for failure to comply with a coercive administrative measure.

In determining the penalty, the circumstances under Art. 29b are taken into account: the degree of impact, the duration, the remedial action taken, cooperation with the authorities and previous infringements. This means that a documented response matters.

This has a practical consequence. If the organisation can show when it identified the problem, what it did, and who confirmed the result, the conversation with the supervisory authority is conducted with evidence, not with assumptions.

• The penalty is imposed independently of the coercive administrative measures the authority may apply.
• When a supervisory authority under Regulation (EU) 2016/679 imposes a penalty for the same act, the competent authorities under this law may impose only measures, not a second pecuniary penalty.
• For infringements committed up to 1 June 2026, fines and pecuniary penalties are imposed at amounts reduced by 50 per cent (Final provisions, § 51).

The penalty rarely comes from the absence of a single measure. Much more often it comes from the inability to prove that the measures were adopted, applied and reviewed. The absence of a trail is treated as the absence of a process.

That is why the approach that works is the reverse of intuition: first the scope is determined, then the current state is assessed, and evidence is attached to every answer. The gaps identified become tasks with an owner and a deadline, and the result goes through a second-person review.