Insights

News

Our latest thinking on the issues that matter most in business and management.

Critical PHP Vulnerabilities: What Are the Risks for Businesses and How Should You Respond?

On 21 October 2026, updates were released for two critical vulnerabilities in PHP - a technology widely used for websites, online stores, and business applications. The vulnerabilities may expose companies to the risk of unauthorized access to systems and data, including where the maintenance of the relevant services has been outsourced. This alert summarizes the specific steps companies should verify with their IT teams and the legal obligations that may arise if an incident is identified.

The EmpCo Directive: Stricter Rules on Green Claims

ESG in Bulgaria after the Omnibus: A Lighter Reporting Landscape

Crypto is no longer invisible to the tax authorities

Problems with easements under the Energy Act impede investors and delay RES projects

There is a need for refinement of municipal practice and in some cases - legal changes

SCC with an interpretative decision on the amount of compensation for copyright infringement

The Bulgarian Supreme Court of Cassation (SCC) has finally brought clarity to the issue of damages for author's rights infringement with a new Interpretative Decision. Тhe issues of determining the amount of damages suffered; the recovery of out-of-court costs and the need to prove non-pecuniary damages are addressed.

Konstantin Kostadinov

DPC contributed the Bulgarian part of World IT Lawyers’ AI Regulation Guide

The guide is designed for private companies that try and want to use AI in their work or implement it, and that have cross-border customers

Desislava Krusteva

DPC Advises on Another Major Photovoltaic Power Plant Sale in Bulgaria

Our dedicated Energy, Projects, and Construction Team provided comprehensive legal support throughout the sale of a 70-megawatt photovoltaic project by Electrawinds Bulgaria

Pencho Stanchev

First steps towards ESG compliance in Bulgarian legislation

Changes to the Accountancy Act introduce new European requirements

Ana-Mari Eremieva

National mechanism for screening foreign direct investment related to the security or public order

Today, the Amendments and Supplements Act to the Investment Promotion Act was promulgated. The Act comes into force on Monday, 11.03.2024, and introduces for the first time a mechanism for screening foreign direct investments in accordance with Regulation (EU) 2019/452 in order to ensure measures for the Bulgarian economy against investments that could endanger national security or public order in Bulgaria.

Nikola Stoychev

DPC advised Evrotrust in a new investment round

Radina Tomanova and Ana-Mari Eremieva worked on this matter.

Radina Tomanova

Are your employees trustworthy enough not to get involved in money laundering?

Anti-money laundering regulation imposes new obligations on companies, with one of the latest amendments to the AMLA introducing policies and procedures to verify the professional competence and reliability of employees implementing anti-money laundering measures

Tsvetelina Koleva

A 10-point guide to success: Basic principles and practical tips for trademark registration

The purpose of this article is to look at one of the most accessible IP rights, namely the trademark. We will look at the first steps in trademark registration, what types of trademarks can be registered and what the benefits are.

Konstantin Kostadinov

October 21, 2026

Critical PHP Vulnerabilities: What Are the Risks for Businesses and How Should You Respond?

On 21 October 2026, updates were released for two critical vulnerabilities in PHP - a technology widely used for websites, online stores, and business applications. The vulnerabilities may expose companies to the risk of unauthorized access to systems and data, including where the maintenance of the relevant services has been outsourced. This alert summarizes the specific steps companies should verify with their IT teams and the legal obligations that may arise if an incident is identified.

Desislava Krusteva

October 22, 2026

The EmpCo Directive: Stricter Rules on Green Claims

From 27 September 2026, public sustainability claims will face clearer and more targeted legal scrutiny. This is particularly relevant for companies operating in Bulgaria

Ana-Mari Eremieva

October 19, 2026

ESG in Bulgaria after the Omnibus: A Lighter Reporting Landscape

Тhe Omnibus has reduced mandatory ESG reporting obligations for most Bulgarian companies and mandatory reporting is now unlikely to apply for them

Ana-Mari Eremieva

October 14, 2026

When Algorithms Decide Who Gets to Work: Key GDPR Lessons from the Uber Fine

Uber’s record GDPR fine highlights the importance of transparency, human oversight and effective safeguards in automated decision-making

Prof. Martin Zahariev, PhD

EU AI Omnibus: A Practical Implementation Roadmap for Businesses

What businesses should do now

Prof. Martin Zahariev, PhD

September 1, 2026

Why Bulgaria may be one of the smartest routes into the EU crypto market

With the end of MiCA’s transitional period, Bulgaria is emerging as an attractive gateway to the EU crypto market by offering a clear regulatory framework, competitive tax and operating conditions, and a MiCA license that enables CASPs to passport their services across the entire European Economic Area

August 25, 2026

Crypto is no longer invisible to the tax authorities

DAC8 makes crypto transactions more transparent to EU tax authorities, requiring crypto service providers to report client transaction data while not introducing new tax obligations for crypto holders.

Ivan Alexander Manev

Bulgaria strengthens AML governance requirements for banks

The latest amendments to the Credit Institutions Act introduce important changes to the regulatory framework for banks, further integrating anti-money laundering and counter-terrorist financing requirements into prudential supervision

Tsvetelina Koleva

Working from home in Bulgaria: Permanent establishments in the age of remote work

The rise of remote and hybrid work has blurred not just the boundary between professional and personal life, but also the tax boundaries between countries. For foreign companies a deceptively simple arrangement such as a person at a laptop in a Sofia apartment, can have significant corporate tax consequences. With this article we would like to offer a brief overview of the issue, how Bulgarian tax authorities currently approach it, and where the law is heading.

Ivan Alexander Manev

New adequacy decision for safe and trusted EU-US data flows

As a consequence of the new decision personal data can flow from the EU to US companies participating in the Framework without additional data protection safeguards.

Desislava Krusteva

The balance between freedom of expression and data protection

The balance between the right to freedom of expression and information and the right to data protection has been the center of discussion for quite some time now, especially in the context of journalistic activities. As both rights are not absolute, the question is – which right overrules the other?

Personal Data Protection in the Context of Assignment of Receivables (Cession) Agreement

Pursuant to the assignment of receivables agreement the creditor under a certain receivable assigns it to a third party. As the assignment procedure involves the processing of personal data of a third party – a debtor that is not a party to the agreement, a thorough examination of the personal data protection rules and their applicability to the assignment of receivables is required.

CJEU Invalidates EU-US Privacy Shield, but Considers the Standard Contractual Clauses Valid?

On 16 July 2020 the Court of Justice of the European Union issued a preliminary ruling with significant importance regarding the instruments for transfer of personal data outside the EU to the so called “third countries”, in particular to the US.

Prof. Martin Zahariev, PhD

December 3, 2020

The European Data Protection Board issued new guidelines on the concepts of data controller and data processor

Оn September 2, 2020 the the EDPB issued Guidelines on the interpretation of the concepts of data controller, joint controller and data processor, providing clarifications and detailed guidance, throughout useful examples, in order to ensure consistent and harmonised approach within the EU and the EEA.

November 17, 2021

New standard contractual clauses under GDPR adopted by the EU Commission

On 04 June 2021 the European Commission issued two sets of standard contractual clauses (SCC) under the General Data Protection Regulation (GDPR): 1. SCC for the transfer of personal data to third countries (below “New Transfer SCC”); and 2. SCC between controllers and processors within EU (below “Controller-Processor SCC”).

Desislava Krusteva

Hristo Nihrizov, Partner at DPC, gave an interview with Radio Plovdiv

Тhe bill on the amendment and supplement to the Personal Data Protection Act, which is to be adopted in the coming months, was also discussed

Martin Zahariev guest in the morning block of TV EUROPE “EUROPE MORNING”

He presented his opinion on the new dating service of Facebook, the Cambridge Analytica scandal...

Desislava Krusteva is now a certified information privacy manager

The newly-acquired certificate is the second one that IAPP has conferred on Ms. Krusteva.

© All rights reserved 2007-2026 Dimitrov, Petrov & Co.

Design by StanVision