Data Protection
Data protection is essential to every business. We prepare the documentation required to comply with Bulgarian and European legislation and advise clients on all matters relating to the processing of personal data.
We begin by mapping processing activities — what data the company collects, on what legal basis, where it is stored and with whom it is shared. Based on this analysis we prepare the documentation that is actually needed, without unnecessary bureaucracy.
We advise on specific matters such as video surveillance, employee data, direct marketing, cookies and analytics tools, as well as transfers of data to third countries.
In the event of a data breach we act quickly — assessing the risk and preparing the notification to the Bulgarian Commission for Personal Data Protection and the communication to affected individuals within the statutory deadlines.
Our services
- GDPR compliance audit and action plan
- Privacy and cookie policies
- Records of processing activities
- Controller–processor and joint controllership agreements
- Data protection impact assessments (DPIA) and legitimate interest assessments
- International transfers and standard contractual clauses
- Employee data processing and video surveillance
- Data breach management
- Responding to data subject requests
- Support for outsourced Data Protection Officers (DPO)
Our approach
We aim for practical compliance — documents that reflect the real business and processes the team can maintain. We also offer periodic reviews, as compliance is an ongoing process rather than a one-off exercise.
Frequently asked questions
Do I need a Data Protection Officer?
The obligation applies to public authorities and where the controller's core activities involve regular and systematic monitoring of individuals on a large scale or large-scale processing of special categories of data. In other cases appointing a DPO is advisable but not mandatory.
How quickly must a data breach be notified?
Where a breach is likely to result in a risk to individuals' rights, the supervisory authority must be notified without undue delay and, where feasible, no later than 72 hours after becoming aware of it.
Can I use cloud services outside the EU?
Yes, subject to the rules on international transfers — an adequacy decision, standard contractual clauses or another permitted mechanism, accompanied where necessary by a transfer impact assessment.
Need legal advice?
Get in touch — we will respond within one business day.