In short: the CPDP (Commission for Personal Data Protection) is Bulgaria's GDPR supervisory authority, to which anyone can complain if their personal data has been processed unlawfully or their rights ignored.
Simply put: Under the GDPR every data subject has the right to complain to a supervisory authority. If a bank, shop or app ignores your request for access to or deletion of your data, uses it without a legal basis or lets it leak — first write to the company. It must reply within one month. If it doesn't, or the reply is unlawful — complain to the authority.
Example: You asked a shop to delete your data after closing your profile. Two months pass with no reply. You complain and attach your dated request.
Watch out: the data protection authority deals with data, not refunds. Fraud — the police; a dispute with a trader — the consumer authority.
Example: Bulgaria — CPDP, 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592; complaints and reports at cpdp.bg.
Check in your country — every EU country has a national data protection authority.
Source: Regulation (EU) 2016/679 (GDPR), Article 77: http://data.europa.eu/eli/reg/2016/679/oj · CPDP: https://cpdp.bg