We help companies organise the processing of personal data so that it complies with the General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act, and so that they can demonstrate compliance when inspected. We start from the company’s actual processes and draft documents that match them, rather than applying ready-made templates.
We represent clients in inspections and proceedings before the Commission for Personal Data Protection and in court appeals against its decisions.
What we do for you
- GDPR compliance programmes: records of processing, privacy notices, internal rules and retention periods
- Handling personal data breaches and notifying the Commission for Personal Data Protection within 72 hours
- Representation in inspections and complaints before the Commission and in court appeals against its decisions
- Assessing obligations under the EU Artificial Intelligence Act when AI systems are introduced
- Legal review of websites and online shops: trader information, terms and conditions, cookies, right of withdrawal
GDPR and Personal Data Protection Act compliance programmes
The General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), supplemented in Bulgaria by the Personal Data Protection Act (PDPA), places the burden of proof on the controller: it must be able to show that it complies with the principles of processing (Art. 5(2) of the Regulation). The work therefore starts with a review of which data the company actually collects, from whom, for what purpose, for how long it keeps them and to whom it passes them. The record of processing activities, privacy notices, contracts with processors and internal rules follow from that review. A document that does not describe actual practice does not demonstrate compliance. Filena Pavlova, an attorney at the Sofia Bar who joined the team in October 2025, works on GDPR and anti-money laundering compliance programmes.
Websites and online shops
The Electronic Commerce Act requires every information society service provider, such as an online shop, to give permanent and direct access to the provider’s name, registered office and management address, contact details including an email address, entry in a public register, VAT registration and, where the activity requires registration or a licence, the supervisory authority (Art. 4). An online shop must provide the information required by Article 47 of the Consumer Protection Act before the order, and the consumer may withdraw from the contract within 14 days without giving reasons (Art. 50), in which case the trader must refund the payments received, including delivery costs, within 14 days (Art. 54).
Since 28 June 2025 e-commerce services have also had to meet the accessibility requirements for persons with disabilities under the Act on Accessibility Requirements for Products and Services. Microenterprises providing services are exempt from these requirements. We review the website, terms and conditions, order and consent forms and notices as a whole, because inconsistencies between them are a common problem.
Frequently asked questions
Does a small company need a record of processing activities?
Usually, yes. The GDPR exempts organisations with fewer than 250 employees, but the exemption does not apply where processing is not occasional, is likely to result in a risk or includes special categories of data. An employer processes its staff’s data continuously, including health data on sick notes, so a record is almost always needed. In June 2026 negotiators for the European Parliament and the Council reached a provisional agreement on relief for organisations with fewer than 1,000 employees where processing is not high-risk, but Parliament has not yet voted on the text and the amendment is not in force.
How quickly must a data breach be reported to the authority?
Without undue delay and, where feasible, within 72 hours of the company becoming aware of the breach, unless the breach is unlikely to result in a risk to the individuals concerned. Where the risk is high, the individuals must also be informed. Every breach, including one that is not notified, must be recorded in an internal register. The notification is filed on the Commission’s form, including by email with a qualified electronic signature.
How can a sanction imposed by the Commission be challenged?
It depends on the proceedings. A decision on a complaint may be appealed under the Administrative Procedure Code within 14 days of receipt. Where an infringement is found in an inspection outside complaint proceedings, a penalty decree is issued, which may be appealed to the district court within 14 days of service; the district court’s judgment may then be challenged on cassation before the administrative court.
Which companies have duties under the Measures against Money Laundering Act?
The obliged entities are listed in Article 4 of the Act: banks and payment institutions, life insurers, investment firms, leasing companies, accountants, auditors, notaries, real estate agents, crypto-asset service providers, lawyers in certain transactions, and others. They must carry out customer due diligence and adopt internal rules within 4 months of registration or licensing. Separately, every company established in Bulgaria, except sole traders, must hold up-to-date information on its beneficial owners and apply for them to be entered in the register where they are not apparent from it.
Practical guides on this topic
Online shop and website legal requirements in Bulgaria: terms, withdrawal, cookies, accessibility
The EU AI Act: what businesses must do and which deadlines have been postponed
GDPR for companies in Bulgaria: required documents, deadlines and what the CPDP checks
AML obligations in Bulgaria: internal rules, due diligence and reporting for obliged entities
Beneficial owners in Bulgaria: which companies must declare them, how and by when
Key contacts for this practice
Briefly describe your matter and we will respond with concrete next steps. We reply within one business day.
Discuss a compliance matter