🇬🇪Law of Georgia on Personal Data Protection
Law of Georgia on Personal Data Protection
The law covers automated and structured non-automated processing in Georgia and certain processing by a controller outside Georgia that uses technical means available in Georgia, except transit-only use.
Core controller and processor duties
Children and special activities: Article 7 governs consent for minors, Article 10 video monitoring, Article 11 audio monitoring and Article 12 direct marketing. Article 19 addresses automated individual decisions.
Transparency and security: Articles 24-25 require information at and after collection. Articles 26-30 cover masking by default for new products, security, processing records, 72-hour incident notification and communication to affected people.
Risk and governance: Article 31 requires DPIAs for high-risk processing. Articles 33-34 govern DPOs and special representatives, while Article 36 governs processors.
Transfers: Articles 37-38 require a permitted basis and, for specified non-adequate transfers, a State Audit Office permit.
An incident process or privacy notice still naming the Personal Data Protection Service should be updated to the State Audit Office before it is relied on operationally.
Articles 7 and 10-12 - minors, monitoring and direct marketing.
Articles 24-31 - information, security, records, incidents and DPIAs.
Articles 33-38 - DPOs, representatives, processors and transfers.