Before you share the employee file: a data checklist for Bulgarian EOR partnerships
An international EOR provider, a Bulgarian employment partner and an end client may all participate in one hire. That does not mean each organisation needs the same employee information.
Before onboarding begins, the partners should be able to explain which information moves between them, why it is needed and who can access it. A signed commercial agreement alone does not answer those operational questions.
For buyers evaluating Bulgarian delivery, this is a practical due-diligence topic. It helps distinguish a clearly designed process from one that depends on forwarding documents whenever somebody asks.
1. Map activities before assigning labels
Avoid assuming that every local employment partner is simply a data processor for the international provider.
The European Data Protection Board explains that controller and processor roles depend on the parties’ actual activities. Contractual descriptions can help, but do not determine the answer by themselves. The assessment concerns who decides the purposes and essential means of processing. EDPB controller and processor guidelines
Apply that assessment to distinct activities, rather than assigning one label to the entire relationship without analysis.
As a practical starting point, list recruitment handover, employment administration, payroll
coordination and client reporting separately. Ask the privacy advisers responsible for the arrangement to confirm the roles and appropriate documentation for each.
2. Make every document request understandable
A useful onboarding request explains what is needed, its purpose, the recipient and the approved submission route.
GDPR’s principles include data minimisation and storage limitation. Its framework also requires a lawful basis for processing and appropriate information for individuals about the use of their data. GDPR, Articles 5, 6, 13 and 14
Operationally, that suggests separating the information needed to assess an enquiry from the
information needed to administer employment.
A commercial contact may initially need a role summary and planned start date. Later document collection should follow the confirmed employment process, rather than becoming an open invitation to send every record available. Have the receiving team explain unusual requests before the employee is asked to fulfil them.
3. Design reports for their recipients
Instead of starting with a complete employee file, begin with the decision a recipient needs to make.
For example, a client contact coordinating onboarding may need a status update showing outstanding actions. That does not automatically justify sending the underlying documents with the update.
Discuss whether reporting can separate commercial information, operational progress and employee records. Give each proposed report a named audience and owner.
During partner evaluation, request a blank or synthetic example – not another employee’s real file. This lets the buyer inspect the format and identify missing information without introducing somebody else’s personal details into the sales process.
4. Agree on the working channel
Ask where documents will be submitted, how access is granted and how access is removed when someone changes roles.
These are process-design questions, not evidence that any particular provider already operates a specific security system. Request a description of the proposed controls rather than assuming that a professional-looking portal settles the matter.
Also ask where information is stored and accessed. Where transfers outside the EEA are involved, the relevant GDPR transfer requirements need assessment. Do not infer the answer from the location of the Bulgarian employing company alone. GDPR, Chapter V
5. Test the process with a simple walkthrough
Before the first live case, walk through a hypothetical correction: an employee reports that a recorded detail is wrong.
Who receives the request? Who checks it? Which systems and partners need the correction? Who confirms completion?
Then discuss a misdirected document and the departure of a staff member who had access. The purpose is to expose unclear handoffs – not to claim that a short exercise proves compliance.
Record the agreed contacts and escalation route alongside the commercial operating process. An employee should not need to understand the entire supplier chain to reach the right person.
Make data handling part of the partnership discussion
A good initial conversation does not require exchanging sensitive employee records. It requires a clear description of the proposed hiring arrangement and the organisations involved.
Evaluating a Bulgarian local partner for an actual hiring need? Contact Excellence BC with your company, expected hiring volume and intended timeline, and identify employee-data handling as an agenda item. Keep the initial enquiry free of employee identity documents.