Contents

  1. 1. Gmail and ABV for official e-mail
  2. 2. Missing SPF, DKIM and DMARC
  3. 3. No cookie banner offering a real choice
  4. 4. A privacy policy from 2018 or 2021
  5. 5. Mixed content – HTTP links on an HTTPS website
  6. 6. Server IP address in the URL
  7. 7. YouTube embeds without cookie consent
  8. What does this mean for your organisation?
  9. What should you do now?

We didn’t need a password. We didn’t need access to the server. We opened the browser, loaded a municipality’s public website and within 15 minutes found 7 violations of the Cybersecurity Act (ZKS), the GDPR and the e-Government Act (ZEU) – each of which can lead to a fine.

Here is what we found – and how to check your own website the same way.

1. Gmail and ABV for official e-mail

On the “Contacts” page we saw employee e-mail addresses at @gmail.com and @abv.bg. This is a triple violation:

  • ZKS, Art. 22, item 5 – lack of control over the supply chain. Google and ABV are not contracted suppliers of the municipality.
  • GDPR, Art. 28 – there is no personal data processing agreement with Google/ABV.
  • ZEU – the administration’s electronic correspondence must be kept in a secure environment.

How to check: Open the “Contacts” page of your website. If you see @gmail.com, @abv.bg or @hotmail.com – you have a problem.

2. Missing SPF, DKIM and DMARC

We checked the domain’s DNS records. There was no SPF, no DKIM and no DMARC. This means that anyone can send fake e-mails on behalf of the municipality.

  • ZKS, Art. 22, item 8 – cryptographic measures and protection of communications.
  • ZKS, Art. 22, item 1 – lack of an information security policy.

How to check: Go to mxtoolbox.com → enter the domain → see whether SPF, DKIM and DMARC records exist.

The website loaded Google Analytics, a YouTube iframe and a Facebook widget before the user gave consent. The cookie banner was either missing or had only an “Accept” button with no option to refuse.

  • GDPR, Art. 6 and Art. 7 – processing of personal data without valid consent.
  • Directive 2002/58/EC (ePrivacy) – consent is mandatory before non-essential cookies.

How to check: Open the website in Incognito mode. If you see YouTube, Facebook or Analytics requests before you click anything at all – that is a violation.

4. A privacy policy from 2018 or 2021

We found a Privacy Policy last updated in 2021. It did not mention the ZKS, NIS2, a DPO contact, or an incident notification procedure.

  • GDPR, Art. 13 and Art. 14 – obligation to provide up-to-date information.
  • ZKS, Art. 23 – incident notification procedure (24/72 hours to SERIKS (CERT-BG)).

How to check: Open the Privacy Policy on your website. Check the date. If it predates 2026 and does not mention the ZKS – it is outdated.

5. Mixed content – HTTP links on an HTTPS website

The website had an HTTPS certificate, but internal resources (images, scripts) were loaded over HTTP. This is mixed content – the browser shows a warning and the page’s encryption is compromised.

  • ZKS, Art. 22, item 8 – cryptographic measures.
  • ZEU, Ordinance on the General Requirements – HTTPS is mandatory for all public systems.

How to check: Open the website in Chrome → F12 → Console. If you see “Mixed Content” warnings – you have a problem.

6. Server IP address in the URL

When certain links were clicked, the URL showed an IP address directly instead of a domain (for example http://185.xxx.xxx.xx:8080/page). This exposes the infrastructure and makes attacks easier.

  • ZKS, Art. 22, item 6 – assessment of the effectiveness of security measures.
  • ZKS, Art. 22, item 1 – risk analysis policies.

How to check: Navigate around the website and watch the URL bar. If you see an IP address or a non-standard port (:8080, :3000) – the server architecture is exposed.

The YouTube videos were embedded with a plain iframe, without youtube-nocookie.com. This means that Google places tracking cookies on the visitor before any consent whatsoever.

  • GDPR, Art. 6 – processing without a legal basis.
  • GDPR, Art. 28 – no processing agreement with Google.

How to check: View the page’s source code (Ctrl+U). Search for “youtube.com/embed”. If it is not “youtube-nocookie.com/embed” – that is a violation.

What does this mean for your organisation?

Each of these 7 violations is publicly visible – no password, no access, no hacking. Any citizen, journalist or inspector from the Ministry of e-Government (MEU) can discover them in minutes.

With the entry into force of the ZKS (State Gazette No. 17/13.02.2026), the MEU will require evidence of compliance, not just declarations. The National Association of Municipalities in the Republic of Bulgaria (NSORB) explicitly warned about this in its advisory material of 13.02.2026.

The sanctions:

  • Personal fine for the head of the organisation: EUR 500–5,000 (Art. 21 ZKS)
  • For failure to comply with an instruction: EUR 2,500–12,000; for a repeat offence EUR 5,000–25,000 (Art. 28 ZKS)
  • Maximum sanction: up to EUR 10,000,000 or 2% of annual turnover (Art. 29 ZKS)

What should you do now?

  1. Free AI scan – our tool checks your public website for the main violations in seconds → avigentis.eu/app
  2. Download the 48-point checklist – the full list of checks across 8 regulatory blocks → Download PDF
  3. Contact us – for a full audit with a report for the MEU → avigentis.eu/kontakt

Avigentis EOOD is a cybersecurity consultant, not a guarantor. Responsibility for compliance with the ZKS lies with the entity (Art. 21 ZKS).

This article is for information only and is not legal advice. For specific advice, contact our team.