GDPR Compliance Checklist for Bulgarian Websites in 2026

GDPR applies to any website collecting personal data of EU residents — regardless of where it's hosted. This checklist covers the minimum.

1. Privacy policy

Mandatory page reachable from every footer:

• Who you are
• What data you collect
• What you use it for
• Legal basis
• How long you keep it
• Third parties you share with
• User rights
• How to exercise rights
• Right to file complaint

2. Cookie policy and banner

• Essential cookies — no consent needed.
• Analytics and marketing cookies — require explicit prior consent.
• Banner must have "Accept all" + "Essentials only".
• Users must be able to withdraw consent.

3. Contact / subscription forms

• Explicit consent checkbox — not pre-ticked.
• Link to privacy policy near the checkbox.
• Record consent timestamp + IP.
• Newsletter checkbox separate.

4. SSL and security

• Full HTTPS.
• Hashed passwords (bcrypt, argon2).
• Regular updates.
• SQLi, XSS, CSRF protection.

5. Backup and breach response

• Daily backup with 14+ day retention.
• Off-site backup.
• Yearly restore test.
• 72 hours to notify DPA and affected users.

6. Processor agreements (DPA)

Third parties processing personal data need a Data Processing Agreement.

7. Data transfers outside EU

Need legal basis: adequacy decision, SCCs, or explicit consent.

8. Logs and processing

• Record what data is processed, why and for how long.
• Maintain Register of Processing Activities (RoPA).
• Server access logs with IPs are personal data.

9. User rights

30 days to respond. Prepare contact channel, identity verification, response templates, data export, deletion across all systems.

10. Penalties

Up to €20M or 4% of global annual turnover. SMBs often hit with €2.5K–25K on first audit.

Quick self-check

1. ☐ Privacy policy in footer
2. ☐ Cookie policy + banner
3. ☐ Analytics gated behind consent
4. ☐ Contact form with explicit consent checkbox
5. ☐ Full HTTPS
6. ☐ Backup + tested restore
7. ☐ DPAs with hosting, email, CRM
8. ☐ Documented process for user requests
9. ☐ Documented breach response

Summary, not legal advice. For a full audit — contact us.