Legal Documents for a Company in Bulgaria — Complete Guide

Why GDPR Policies Are Mandatory

Since May 25, 2018, Regulation (EU) 2016/679 (GDPR) requires every person or organization processing the personal data of EU citizens to have documented policies and procedures. Violations carry sanctions of up to 20 million euros or 4% of global annual turnover. The supervisory authority in Bulgaria is the Commission for Personal Data Protection (КЗЛД) — www.cpdp.bg.

Data subjects have the right to file a complaint directly with the Commission under Art. 77 of the GDPR if they believe the processing of their personal data violates the regulation. Every company is required to provide information about this right in its privacy policy.

Every website, mobile application, or online store with users from the EU is required to publish:

• Privacy policy — what data you collect and how you process it
• Cookie policy — types of cookies, duration, and whether consent is required
• Notice under Art. 13/14 of the GDPR — when collecting data directly

Terms of Service — the Legal Foundation of Your Business

Terms of Service (Terms & Conditions) regulate the contractual relationship between the service provider and the user. Without them:

• You have no legal basis for limiting liability
• You cannot invoke force majeure clauses
• Users can claim unlimited liability

Non-Disclosure Agreement (NDA)

An NDA (Non-Disclosure Agreement) is signed before:

• negotiations with potential partners or investors
• engaging contractors with access to internal data
• pilot projects with clients

In Bulgaria, it is governed by the Obligations and Contracts Act (ЗЗД). Notarial certification is not mandatory.

Service Agreement

A standard B2B service agreement covers:

• subject and scope of the service
• deadlines and milestones
• price, payment method, and schedule
• intellectual property rights over the results
• liability and penalties
• termination and cancellation

Data Processing Agreement (DPA)

When you hire a cloud services provider, email marketing platform, CRM, or any other service involving personal data, you must sign a Data Processing Agreement (DPA) under Art. 28 of the GDPR. The absence of one is an independent violation of the regulation.