Skip to content
For businesses in Bulgaria
COMPLWISE · BUSINESS SERVICES

Personal data (GDPR)

Check whether your GDPR documents reflect how your company processes personal data today

Service price49 €One-time · Payment before the questionnaire
No account required · Assessment before generation

Check your company

Who it is for

Companies processing personal data, regardless of employee count.

01

What we check

Six areas that determine the actions needed.

01

Data and purposes

Data categories, affected individuals, purposes and lawful bases.

02

Transparency and rights

Notices and request procedures for staff, applicants and customers.

03

Retention and security

Retention periods, access, deletion and incident response.

04

Suppliers and transfers

Processors, contracts and transfers outside the EEA.

05

Records, DPO and DPIA

Assess which specific record, DPO and DPIA requirements apply.

06

Website and tools

Forms, cookies, analytics, marketing and AI use.

02

How it works

From company information to the final documents.

  1. 01

    Company

    Enter EIK and review the company details.

  2. 02

    Payment

    One-time payment; return to the questionnaire.

  3. 03

    Questionnaire

    Service-specific questions and optional uploads.

  4. 04

    Documents

    Selection according to your answers and priorities.

  5. 05

    Preview

    Review the generated package; no second payment.

  6. 06

    Download

    Download link; files deleted after five days.

03

Documents and review priorities

Click a document name for its purpose, contents and applicability.

P1 — review first · P2 — case dependent · P3 — specialist review. These are review priorities; the questionnaire determines the final package.

P1 · Review firstAn internal data protection policy and allocation of responsibilities
Purpose
Defines applicable rules and their practical implementation within the company.
What it covers
Scope, roles, permitted actions, restrictions, deadlines and review.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P1 · Review firstPrivacy notices for employees, candidates, customers and other individuals
Purpose
Provides understandable information to the people concerned.
What it covers
Activities, purposes, recipients, periods, rights and contacts appropriate to the case.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P1 · Review firstRetention and deletion rules
Purpose
Sets out when information is retained, reviewed and deleted.
What it covers
Record categories, periods, grounds, responsibilities and deletion process.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P1 · Review firstProcedures for responding to individual rights requests
Purpose
Defines the process for requesting and providing information.
What it covers
Request recipient, checks, deadlines, response and evidence of completion.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
More documents (8)
P1 · Review firstAccess control and organisational security rules
Purpose
Allocates access and information protection measures.
What it covers
Permissions, responsible persons, restrictions, safe sharing and checks.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P2 · Case dependentRecords of processing activities, where required
Purpose
Describes the actual personal data processing operations.
What it covers
Purposes, categories of individuals and data, recipients, transfers, retention and security measures.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P2 · Case dependentAgreements with data processors and supplier assessment documents
Purpose
Clarifies relationships with external providers and their responsibilities.
What it covers
Service, instructions, access, confidentiality, safeguards and contractual commitments.
When it is included
Where an external provider is involved; the package depends on the service and relationship between the parties.
P2 · Case dependentA personal data breach response procedure and incident records
Purpose
Maintains a structured record of activities and responsibilities for this service.
What it covers
Activities or events, responsible persons, dates, versions and traceable records.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P2 · Case dependentAssessment of whether a data protection officer is required
Purpose
Documents the specific part of the procedure identified by the document name.
What it covers
Company details, specific actions, responsible persons and relevant attachments.
When it is included
Applicability depends on activities, existing documents and questionnaire answers.
P2 · Case dependentWebsite privacy and cookie documentation relevant to actual technologies used
Purpose
Describes the technologies used and arrangements for information and choice.
What it covers
Categories, purposes, suppliers, lifetimes and applicable consent or refusal settings.
When it is included
Where the website uses cookies or other tracking technologies; the actual configuration is assessed.
P3 · Specialist reviewDocumentation for international transfers
Purpose
Documents data transfers to recipients in other countries.
What it covers
Recipients, countries, applicable mechanism, safeguards and relevant assessments.
When it is included
Where a specific requirement or risk is identified; a qualified specialist may be needed.
P3 · Specialist reviewA data protection impact assessment, where applicable
Purpose
Assesses the effects of processing on individual rights and freedoms.
What it covers
Processing description, risks, necessity and proportionality, measures and conclusion.
When it is included
Where a specific requirement or risk is identified; a qualified specialist may be needed.
Detailed requirements, dates and sourcesLegal information and details for specific cases
About this service

A privacy notice or a set of policies prepared years ago may no longer describe your actual activities. New employees, customers, software, suppliers and AI tools can all change your obligations.

Complwise compares your processing activities with the applicable requirements and the documents you already have, so you can identify what needs to be prepared or updated.

What is the GDPR?

The General Data Protection Regulation — Regulation (EU) 2016/679 — governs the processing of personal data. It covers information relating to identifiable individuals, including employees, job applicants, customers, website visitors, suppliers and other contacts.

Compliance involves both documentation and the way data is collected, used, shared, protected and deleted. A company must be able to demonstrate that its processing complies with the applicable rules.

Who does it apply to?

Companies processing personal data may have obligations regardless of their employee count. Applicability depends on the activities, data, organisational role and risks involved.

  • Employers processing personnel and recruitment information.
  • Businesses handling customer, supplier or contact data.
  • Websites using forms, accounts, newsletters or tracking tools.
  • Organisations using CRM, cloud services, outsourced payroll or other processors.
  • Companies processing sensitive data, monitoring individuals or transferring data internationally.

A small team does not automatically remove the need for a processing record, a data protection officer or a data protection impact assessment. Each requirement needs an individual assessment.

Why is this necessary?

Documents must describe real processing, rather than simply reproduce a template. The assessment covers purposes, lawful bases, transparency, retention, recipients, security, individual rights and accountability.

Existing documents are a starting point

A policy written for a business in 2022 may not cover its current HR platform, CRM, newsletter provider, analytics, cloud storage or AI tools. A document can exist and still need updating.

Complwise checks both whether you have a document and whether its contents correspond to your current activities.

When should GDPR documentation be updated?
  • New software, systems or AI tools.
  • New suppliers or processors.
  • New categories of data or purposes of processing.
  • Changes to retention periods, access rights or security arrangements.
  • Transfers outside the European Economic Area.
  • Sensitive data, profiling or automated decision making.
  • A security incident or identified deficiency.
  • Relevant changes to legislation, guidance or case law.
Regulatory changes

Relevant developments include EU and Bulgarian legislation, guidance from the European Data Protection Board, supervisory decisions and rules on international transfers.

With regulatory monitoring activated, changes relevant to the service can be linked to the processing activities and documents concerned. Notifications continue until you unsubscribe.

Who supervises compliance?

Commission for Personal Data Protection (CPDP)

The Bulgarian supervisory authority exercises its statutory powers in relation to personal data protection. European Data Protection Board guidance also helps interpret the GDPR consistently across the EU.

The relevant authority and procedure depend on the processing and the circumstances of the case.

What can happen if the rules are breached?

Administrative fines depend on the provision infringed and the circumstances. Article 83 distinguishes between categories with ceilings of:

  • Up to €10 million or 2% of total worldwide annual turnover, whichever is higher.
  • Up to €20 million or 4% of total worldwide annual turnover, whichever is higher.

These are maximum ceilings, not an automatic fine for every missing document. Supervisory measures may also include orders to bring processing into compliance, restrictions or other corrective action.

What might your company need?

The appropriate package is determined by your processing activities. It can include:

  • Records of processing activities, where required.
  • An internal data protection policy and allocation of responsibilities.
  • Privacy notices for employees, candidates, customers and other individuals.
  • Retention and deletion rules.
  • Agreements with data processors and supplier assessment documents.
  • Procedures for responding to individual rights requests.
  • A personal data breach response procedure and incident records.
  • Access control and organisational security rules.
  • Documentation for international transfers.
  • A data protection impact assessment, where applicable.
  • Assessment of whether a data protection officer is required.
  • Website privacy and cookie documentation relevant to actual technologies used.

Not every company needs every document. The assessment identifies the applicable requirements and the evidence needed.

How does the GDPR check work?
  1. 01

    Identify the company

    Start with your Bulgarian company identification number (EIK). Current company details provide the basis for the documents to be prepared.

  2. 02

    Describe the processing

    Answer questions about staff, customers, systems, suppliers, data categories, purposes, retention and transfers.

  3. 03

    Identify existing documents

    List the documents you have and optionally upload them for review. You do not have to start again with a new template.

  4. 04

    Assess applicable requirements

    The assessment considers your role, activities and risk, including the need for a processing record, a DPO and a DPIA.

  5. 05

    Review your GDPR gap analysis

    Requirements and documents are classified as current, requiring review, requiring an update, missing or not applicable. You can see the reason for each finding.

  6. 06

    Select the documents

    Choose the preparation or update work that addresses the identified gaps.

  7. 07

    Review, pay and download

    Review the documents before payment. After payment, receive the final documents and a download link by email. Generated files are automatically deleted after five days.

Already have GDPR documents?

Review them rather than starting from scratch

Upload existing notices, policies, processing records and agreements. The assessment distinguishes documents that remain suitable from those needing a review, an update or replacement, and identifies missing items.

An existing document is assessed against the current processing activities and the requirements applicable to your company.

Keep track after the initial check

With monitoring activated, your service record can track relevant regulatory changes, processing activities, suppliers, document versions, tasks and deadlines. Review your information when the business changes.

Your business changes. Your GDPR documentation should keep pace.

Official sources

GDPR — Regulation (EU) 2016/679 · CPDP · EDPB

Main implementation dates last checked: 3 October 2026. Applicability is assessed for the individual case.