Georgia's Personal Data Protection Law: What a Foreign-Owned Company Has to Do
The Law of Georgia on Personal Data Protection applies to a five-person software company as fully as to a bank. It asks for a legal ground for every use of personal data, answers to individuals within ten working days, a written agreement with every processor, a record of processing, and notice of a serious incident within 72 hours. Since 2 March 2026 the supervisor is the State Audit Office.
A foreign-owned company registered in the country of Georgia becomes a data controller under Georgian law on the day it holds its first customer list, payroll file or sign-up form. The Law of Georgia on Personal Data Protection, whose main provisions have applied since 1 March 2024, does not scale its core duties by size: a legal ground for each use of personal data, answers to individuals within fixed periods, security, records, a written agreement with every processor, and notice of serious incidents. It reads much like the GDPR and is not the GDPR; the differences are where foreign founders slip.
72 hours
To notify the supervisor of an incident
From discovery, unless significant harm is unlikely
10 working days
To answer most requests from individuals
For information and access, up to 10 more in special cases
GEL 20,000
Ceiling on combined fines from one inspection
GEL 10,000 where annual turnover is up to GEL 500,000. All three as in the Law at the time of writing
When the law applies to your company
The Law covers processing of personal data in the territory of Georgia by automated means, and paper records kept in a filing system. A Georgian LLC is covered for what it processes here, whoever the people concerned are. A controller decides why and how data is processed; a processor handles it on the controller's behalf. The Law also reaches a company registered outside Georgia that processes data with technical means located in Georgia, other than for mere transit. Such a company first appoints and registers a special representative in Georgia, unless it is established in the European Union under EU rules, or in a country the EU has recognised as adequate.
One change affects every older template. A law of 17 December 2025 liquidated the Personal Data Protection Service on 2 March 2026. From that date the State Audit Office is its legal successor and continues its pending cases, and the Law names that Office wherever it named the Service: notifications, complaints and inspections go there, and normative acts and decisions in this field are issued by the Auditor General. Rules issued under the Law and in force on 1 March 2026 keep their force until replaced; the power to amend or repeal them passed to the Auditor General. The periods and amounts below are those of the Law after that amendment.
Processing of personal data is permitted where one of the listed grounds exists, among them: the data subject's consent for one or more specific purposes; necessity for performing a contract with the data subject or for entering into one at their request; a requirement of law or a duty imposed on the controller by Georgian legislation; protection of vital interests; and protection of the significant legitimate interests of the controller or a third party, unless the interest in protecting the data subject's rights prevails. The controller carries the burden of substantiating the ground.
The legal grounds a small company actually relies on
- Contract: customer accounts, orders, invoices and support, as far as the data is needed to perform the contract.
- Legal duty: payroll, tax and pension records, and customer due diligence files where the company is an accountable entity under the anti-money-laundering law.
- Consent: anything the service does not need. It has to be free, specific and informed; withdrawing it has to be free of charge, simple and possible in the same form in which it was given; and the controller has to prove that consent exists.
- Direct marketing: consent is required whatever the source of the data. Beyond name, address, telephone number and email address it has to be written, and a request to stop is honoured within seven working days at the latest.
- Significant legitimate interests, unless the person's rights outweigh them. Special categories, among them health data and criminal records, need a narrower ground, usually written consent or a specific law.
What individuals can ask for, and how fast you must answer
| Request | What the company does | Period |
|---|---|---|
| Information about processing | Confirms whether data is processed, on what ground, for how long and who received it | 10 working days |
| Access and a copy | Shows the data and gives a copy, free of charge as a rule | 10 working days |
| Correction or completion | Corrects the data, or refuses with reasons and explains how to appeal | 10 working days |
| Stopping, erasure or destruction | Complies, or refuses on a ground the Law allows and explains it | 10 working days |
| Blocking | Decides and informs the person | 3 working days |
| Withdrawal of consent | Stops and deletes, unless another ground exists | 10 working days |
At the moment of collection the company tells the person, in plain language, who it is, why and on what ground it processes the data, who receives it, whether it goes abroad, how long it is kept and what the person's rights are; in practice this is the privacy notice. And a person who is refused can complain to the State Audit Office or to a court, where the company carries the burden of proof.
The standing file: records, security, processors and impact assessments
- A record of processing: purposes, categories of data and of people, recipients, transfers abroad and their safeguards, retention periods, security measures in outline, and incidents. The supervisor can ask for it and must receive it within three working days.
- Security proportionate to the risk: access limited by role, a log of actions taken on electronic data, and staff bound to confidentiality.
- A written agreement with every processor, stating the grounds and purposes, the categories of data and the duration. The processor acts only on written instructions, returns or deletes the data at the end, and uses a sub-processor only with prior written consent; the controller monitors it.
- A written impact assessment, made in advance, where processing is likely to put fundamental rights at high risk, and in any case for fully automated decisions with significant effect, for special-category data of a large number of people, which the Law puts at 3 percent of Georgia's population or more, and for systematic large-scale monitoring in public places.
- Data protection built into new products, so that by default only the data needed is processed. As a rule, software created before 1 March 2024 is outside this duty unless significantly updated since.
Whether the company must also appoint a data protection officer is a separate test, by sector and by scale, covered in two articles on this site: who must appoint an officer, and outsourcing the role.
A breach is always recorded, and often notified within 72 hours
The Law calls a breach an incident: a failure of security that leads to the loss, disclosure, destruction or alteration of data, or to unauthorised access. The controller records every incident, its consequences and the measures taken. Unless the incident is unlikely to cause significant harm or a significant threat to fundamental rights and freedoms, the controller also notifies the State Audit Office no later than 72 hours after discovering it, and a processor tells its controller immediately. Where significant harm is highly likely, the people affected are told without undue delay and in plain language.
The storage bucket that was public for three days
A Tbilisi software company keeps a database of 40,000 app users with a cloud host. On a Friday at 18:00 an engineer discovers that an export of names, email addresses and password hashes had been publicly readable for three days.
- 1The clock starts at discovery, Friday 18:00, not on Monday morning, and ends on Monday at 18:00.
- 2The incident goes into the company's record whatever is decided next.
- 3The company assesses the risk. Contact details with password hashes can be used for phishing and account takeover, so it cannot say that significant harm is unlikely, and it notifies.
- 4The notification goes to the State Audit Office with the facts known so far: what happened, which data, roughly how many people, the measures taken or planned, whether and when the users will be told, and a contact person. The rest may follow in stages, by agreement with the Office.
- 5The users are told in plain language and asked to change their passwords, because the company judges the likelihood of harm to be high.
Silence would have added an offence to the incident. At the time of writing, not notifying the supervisor carries a warning or a fine of GEL 2,000, or GEL 3,000 where annual turnover is above GEL 500,000, and not informing the people affected GEL 3,000 or GEL 5,000.
Illustrative. Whether an incident has to be notified is assessed on its facts under the supervisor's criteria; amounts as in the Law at the time of writing.
Sending data out of Georgia
Most foreign-owned companies send data abroad daily: to a parent, a cloud host, a payroll provider. A transfer is allowed where the processing itself is lawful and the receiving state or international organisation ensures appropriate safeguards; the list of such states is set by a normative act of the supervisor and should be read in its current version. The controller may secure the safeguards in a contract with the recipient, but that route needs the permission of the State Audit Office before the transfer. The person may give written consent after being told that safeguards are absent and what the risks are. The remaining routes are an international treaty, a transfer provided for by one of the laws the Law lists, the person's vital interests where they cannot consent, and a significant public interest.
How close the law is to the GDPR
| Topic | Georgian law | GDPR in outline |
|---|---|---|
| Legal grounds | A list that includes consent, contract, legal duty and significant legitimate interests | A comparable list; consent is one ground among several in both |
| Requests from individuals | Fixed periods counted in working days | Its own periods; do not assume they match |
| Breach notification | To the State Audit Office within 72 hours of discovery, unless significant harm is unlikely | The same model: prompt notice to the supervisory authority, subject to a risk test |
| Transfers abroad | A Georgian list of countries with appropriate safeguards; the contract route needs the supervisor's permission | Its own adequacy decisions and contractual tools; the two lists are separate |
| Fines | Fixed amounts in lari, capped per inspection | A different scale, tied to the size of the business |
A Georgian company that offers services to people in the European Union may be subject to the GDPR as well, on its own territorial test. Complying with the Georgian law does not answer that question, and a programme built for the GDPR still needs the Georgian periods, supervisor and transfer rules.
What an inspection and a fine look like
The State Audit Office may inspect any controller or processor, ask for any document and enter the premises; requested material is handed over at once, or within 10 working days where it has to be gathered. If it finds a breach it can order a correction, suspend or stop the processing, stop transfers abroad, or impose a penalty. The penalties are fixed amounts in two tiers, divided by whether annual turnover is above GEL 500,000. At the time of writing, processing without a legal ground carries a warning or a fine of GEL 1,000 in the lower tier and GEL 2,000 in the upper, and a security failure or an unlawful transfer abroad GEL 2,000 and GEL 4,000; the amounts rise in aggravating circumstances, such as a repeat within a year. Fines for several breaches found in one inspection are capped at GEL 10,000 and GEL 20,000. Stopping the breach, repairing the harm and cooperating reduce a fine by 20, 30 or 50 percent. A penalty has to be imposed within four months of the breach or, where it continues, of its discovery, and the decision can be appealed to a court within one month of official notification.
Next step
Put the file in order before someone asks for it
We map what a company processes, write the privacy notice, the processor agreements and the incident procedure in Georgian and English, and hold the data protection officer role where the Law requires one. We do not certify compliance with the GDPR, and we do not replace counsel in the countries where your users live.
Book a data protection callWhat this article does not answer
Video and audio monitoring, biometric data and the data of children each have rules of their own in the Law. Sector rules, such as banking secrecy, medical confidentiality and anti-money-laundering record keeping, sit on top of it. Whether the GDPR or another foreign law also applies depends on where your users are, and is a question for counsel there. Nor does this article reproduce the supervisor's normative acts, such as the incident criteria and the list of countries with appropriate safeguards.
General information, not legal advice. Processing of personal data in Georgia is governed by the Law of Georgia on Personal Data Protection and by the normative acts of the supervisory authority, which since 2 March 2026 is the State Audit Office; the Law has been amended repeatedly, and the official Georgian text governs.