GDPR for a Small Company in Bulgaria — What You Actually Need

Most small companies process more personal data than they think: employees and payroll, customers and invoices, a contact form on the website, a camera at the entrance. The GDPR applies to all of it, whatever the size of the business, and Bulgaria adds a few rules of its own through the Personal Data Protection Act. The good news is that for a typical small company, compliance comes down to a short list.

The core documents

• Privacy notices — one for customers and website visitors, one for employees: what you collect, why, on what legal basis, for how long and who receives it.
• A record of processing activities. Companies with fewer than 250 employees are exempt only if their processing is occasional — and payroll is not, so nearly every employer needs at least a short record.
• Contracts with processors — your external accountant or payroll provider, IT support, cloud and hosting services — containing the terms Art. 28 GDPR requires.
• A retention schedule — how long each category of data is kept, and when it is deleted.
• A breach procedure — who decides, who notifies the CPDP and the people affected, and how incidents are logged.

Bulgarian rules on top of the GDPR

• Job applicants. Data of unsuccessful candidates may be kept for no more than six months after the recruitment ends, unless the candidate agrees to a longer period. Copies of documents proving their qualifications should not be kept beyond that period either.
• Copies of ID documents. You may not copy a customer’s or employee’s identity card or passport unless a law provides for it. Write down the details you need instead of photocopying the card.
• Employee monitoring. Access control, working-time recording and internal reporting systems need internal rules that set out their scope and how the data are used, and staff must be told about them.
• Children. For online services offered directly to children, a child can consent from the age of 14; below that, a parent or guardian must.
• Other laws come first. Under the Accounting Act, payroll records are kept for 50 years and accounting records for 10. The GDPR does not shorten these periods.

CCTV

Video surveillance of business premises is common and lawful when it has a clear purpose — the security of people and property — and stays proportionate. Put up signs before people enter the camera’s field of view, never film areas such as toilets and changing rooms, avoid filming the street or the neighbours more than necessary, keep footage only for a limited period and restrict who can see it. If employees are filmed, cover it in the internal rules.

Website and cookies

Analytics and advertising cookies need the visitor’s prior consent; strictly necessary cookies do not. Contact forms should link to the privacy notice and ask only for what you need. If your tools send data outside the European Economic Area — many US services do — check the basis for the transfer, such as the EU–US Data Privacy Framework or standard contractual clauses.

When something goes wrong

1. Contain

   Stop the leak — change passwords, recall the email, disable the account.

2. Assess

   What data, how many people and what risk to them.

3. Notify

   If people’s rights are at risk, notify the CPDP within 72 hours; if the risk is high, inform the people affected as well.

4. Record

   Log every breach, including those you decided not to notify, with your reasoning.

Questions clients ask

This guide is general information about Bulgarian law as it stood on the date of publication. It is not legal advice for your specific case. Unfamiliar terms are explained in our glossary.