All practice areas

GDPR AND PERSONAL DATA PROTECTION LAWYER IN PLOVDIV

GDPR and personal data protection

Lawyer Miroslav Mirchev is a lawyer in Plovdiv who specialises in personal data protection and compliance with the requirements of the GDPR. He advises controllers and processors of personal data on introducing and maintaining compliance with the General Data Protection Regulation (Regulation (EU) 2016/679) and the Personal Data Protection Act.

GDPR compliance is not a one-off task. It covers documentation, internal rules and contracts with providers. A properly built system reduces both the risk of penalties and the risk of claims from affected individuals.

Every business that processes personal data is required to comply with the GDPR. It is enough to have a website with accounts or a contact form, to collect data through cookies, or to keep a customer database. These services are most often needed by newly incorporated companies that want to start with proper documentation, by companies that have not updated their documents for some time, and by companies that have never had such documents.

The most common problem is missing or incomplete documentation: there is no privacy policy, or it does not contain all the required elements. Documents generated with artificial intelligence are also increasingly common. They contain generic wording that does not reflect which data is processed, on what basis and for how long on the specific website, and they therefore risk failing to meet the requirement to inform individuals. Documentation is effective only when it describes the real activity of your business.

Защита на личните данни и съответствие с GDPR

Services in the field of personal data protection

GDPR and personal data protection

GDPR audit of your activities

Review of processing and identification of non-compliance.

GDPR and personal data protection

Data protection officer (DPO) as a service

An external data protection officer (DPO) as a service.

GDPR and personal data protection

Privacy policy and information notices for data subjects

For websites, online shops, mobile apps and forms.

When you need a personal data protection and GDPR lawyer

  • when you launch a website, an online shop or an app that collects data
  • when you process data of employees, customers or patients
  • when you use providers who have access to your data
  • when data has been leaked, lost or accessed without authorisation
  • when you have received a request from a customer, employee or third party for access to or erasure of data, or you are about to submit such a request
  • when you introduce video surveillance or an access control system

Frequently Asked Questions

Who is required to appoint a data protection officer (DPO)?
The law requires a DPO in three cases: (1) where the processing is carried out by a public authority; (2) where the core activities require regular and systematic large-scale monitoring of data subjects; and (3) where the core activities consist of large-scale processing of special categories of data or of data on criminal convictions and offences. Outside these cases, appointing a DPO is voluntary, but it may prove practical where processing is more extensive.
Is consent required for cookies?
Technically necessary cookies do not require consent. Analytics, marketing and tracking cookies require prior, informed and freely given consent, meaning that a banner which loads these cookies before the user has chosen does not comply with the requirements. Refusing must be just as easy as accepting.
Does my website need a privacy policy?
Anyone who collects personal data, including a name, a delivery address, an email address or an IP address, is required to inform data subjects of the purposes, the legal bases, the retention periods and their rights. The absence of such information is a violation in its own right, even if the data is otherwise processed correctly.
Can I use a policy generated by artificial intelligence or from a template?
It is not prohibited, but it is risky. Generated documents describe a typical business, not yours: they do not name the real providers, periods and legal bases. A policy is useful only if it matches what the website actually does.
What should I do if personal data is leaked?
In the event of a personal data breach, the controller notifies the Commission for Personal Data Protection without undue delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to individuals’ rights. Where the risk is high, the affected individuals are also notified. Every breach is documented internally, whether or not it has to be notified.
How long do I have to respond to a request from a data subject?
The response is provided without undue delay and in any event within one month of receiving the request. For complex or numerous requests the period may be extended by a further two months, with the data subject informed of the extension and the reasons for it within the first month.
What are the penalties for violating the GDPR?
The Regulation provides for two tiers: up to EUR 10,000,000 or 2% of total worldwide annual turnover for some infringements, and up to EUR 20,000,000 or 4% for the more serious ones, such as breaches of the basic principles, of data subjects’ rights or of the rules on international transfers. The higher of the two amounts applies. In addition to the administrative penalty, any affected individual may also claim compensation through the courts.