A new CRM provider, an outsourced support team or an IT contractor may need access to information about your customers. The commercial agreement might be ready, while the practical questions about that access remain unresolved.
For an international business operating in Bulgaria, it helps to review the service, the data arrangements and the internal approval together—before access is enabled.
Start with the access the supplier actually needs
“Access to our systems” is too broad a description for a useful review.
Ask your team to identify:
- Which system the supplier will use.
- What customer information will be visible.
- Whether access includes downloading, changing or deleting records.
- Who within the supplier’s organisation will have access.
- Whether the work can be completed using less information.
Separate temporary implementation access from the permissions needed to provide the ongoing service. A supplier configuring a system may need different access from a supplier answering customer enquiries.
Document the intended arrangement in plain language. This gives the people reviewing the contract something concrete to assess.
Establish the supplier’s data protection role
A supplier’s role depends on what it actually does with personal data. The commercial label “service provider” does not resolve that question.
Where a supplier processes personal data on your company’s behalf, GDPR Article 28 requires a binding contract or other qualifying legal act addressing that processing. It must be in writing, including electronic form.
Not every supplier relationship falls into that category. Establish the parties’ roles before selecting a template or accepting the supplier’s standard data terms.
Read the data terms alongside the service agreement
A data processing agreement should fit the service your business is buying.
For a processor arrangement, Article 28 addresses matters including documented instructions, confidentiality, security, other processors, assistance with relevant obligations, audit information and the return or deletion of data when the service ends.
The practical review should also ask:
- Does the description of the processing match the proposed service?
- Are the relevant data categories and individuals identified?
- Can your team meet any responsibilities assigned to the customer?
- Do the service agreement and data terms describe compatible exit arrangements?
A signed document is less useful if nobody can explain how it applies to the actual work.
Ask about other providers and overseas access
Find out whether the supplier relies on other organisations to deliver the service and where access or processing will take place.
Ask for a clear explanation of hosting, support access and any proposed changes to those arrangements. If access or transfers outside the EEA are involved, flag them for a separate assessment of the applicable transfer requirements.
An EU-facing website or a European invoicing address is not a substitute for understanding how the service operates.
Agree who approves, monitors and removes access
Give the relationship an internal owner. That person should know who can approve additional permissions, where the agreed documents are stored and how to raise a concern with the supplier.
Before onboarding, decide how your business will:
- Record the access granted.
- Review whether it remains necessary.
- Handle changes in the supplier’s service or personnel.
- Remove access when the work ends.
Keep the commercial and technical teams involved. Legal wording cannot, by itself, ensure that permissions are configured or removed correctly.
Plan the exit before the service begins
Consider what your business would need if it changed providers.
Discuss how information will be returned, what assistance is available and how remaining copies will be handled. Check these arrangements against the contract and your operational needs.
A useful exit plan identifies the steps, the responsible people and the points that require further agreement. It should not depend on reconstructing the relationship after a disagreement has arisen.
Make supplier changes part of routine legal review
This review is particularly useful when a supplier receives broader access, adds a new service or changes how customer information is used.
Businesses with recurring supplier and contract questions can include these matters within an individually agreed scope of ongoing legal support in Bulgaria.
If you would like to discuss a proposed supplier arrangement, contact Vasil Petrov or email office@petrov-bg.com. Describe the service and any immediate deadline; please wait to send confidential documents or customer data until the matter has been discussed.
General information, checked on 11 November 2026. This article is not legal advice. An enquiry does not establish an attorney–client relationship.