Data Protection & Whistleblowing

Navigating personal data protection and whistleblower protection compliance is increasingly critical in today’s regulatory landscape. This practice provides tailored legal guidance across the full spectrum of personal data management, including cross-border data transfers, internal data protection policies, and regulatory compliance and engagement under the GDPR and applicable Bulgarian legislation. Support is also provided to businesses in introducing effective whistleblowing frameworks in accordance with the Bulgarian Whistleblower Protection Act, ensuring timely and lawful handling of internal alerts, registration procedures, and reporting channels. Rooted in practical experience with regulatory implementation, the approach facilitates full аlignment with both European and local legal requirements.

Legal advice is tailored to companies across industries such as technology, healthcare and life sciences, manufacturing and product innovation, retail, consumer brands, and hospitality.

Core areas of expertise:

• Data Protection Governance & Internal Compliance
  Legal assessment of data handling practices and overall compliance readiness. Support with audits and documentation of data flows and processing activities. Preparation of internal rules and procedures for handling personal data in both physical and digital formats. Advice on the designation and responsibilities of a Data Protection Officer (DPO), including ongoing compliance support.

• Privacy Notices, Policies & Contractual Safeguards
  Development and revision of privacy notices, employee disclosures, cookie policies, and website-related compliance materials. Drafting and review of controller–processor agreements and other relevant contractual arrangements. Legal advice on valid grounds for processing, including consent management and legitimate interest balancing tests. Legal guidance on cross-border data transfers, with implementation of appropriate safeguards such as Standard Contractual Clauses.

• Regulatory Interaction & Capacity Building
  Representation before the Commission for Personal Data Protection (CPDP) in audits, investigations, and breach scenarios. Training and briefings for employees, management, and internal DPOs on privacy obligations and practical implementation.

• Whistleblowing Compliance under Bulgarian Law
  End-to-end assistance in setting up internal whistleblower reporting systems in accordance with Bulgarian legislation. Drafting internal rules and procedures for handling alerts, protecting whistleblowers, and ensuring confidentiality. Advice on the registration and secure logging of reports, including recordkeeping obligations. Staff and management training on rights, obligations, and internal roles under the Whistleblower Protection Act. Support in aligning whistleblowing mechanisms with data protection and labor law requirements. Representation before competent authorities in case of complaints, inspections, or enforcement actions.