Educational technology platforms process the personal data of minors every day: names, ages, contact details, learning results and behavioural statistics. In Georgian law this relationship is governed by the Law of Georgia on Personal Data Protection, which contains a dedicated regime for minors. This page examines what the statute requires of an educational platform — from the lawful basis of each operation to the 72-hour incident notification — and marks the deliberate boundary of the discussion: the status, authorisation and curriculum regulation of educational institutions form a separate legislative sphere whose norms we do not cite here.
Principles and Lawful Bases of Processing
Article 4 sets the principles binding every controller: data must be processed lawfully, fairly and transparently for the pupil and without violating their dignity; collected only for specific, clearly defined and legitimate purposes; processed only to the extent necessary; kept accurate; stored no longer than necessary; and protected by appropriate technical and organisational measures.
Article 5 requires every operation to rest on a lawful basis: consent, a contract with the pupil or steps at their request, a legal provision, a legal obligation, publicly available data, vital interests, a significant public interest or legitimate interests. For a platform this means every function — registration, analytics, communication — must be mapped in advance to its basis, and the burden of substantiation lies on the controller.
The Age of the Pupil and the Consent Regime
The central rule for minors is Article 7: processing of a minor’s data on the basis of consent is permitted if the minor has reached the age of 16, while data of a minor under 16 may be processed with the consent of a parent or other legal representative. The law also contemplates cases where the consent of both a minor between 16 and 18 and the representative is required.
The platform must take reasonable and adequate measures to verify that the consent of the parent or representative of a pupil under 16 exists. Special categories of a minor’s data may be processed only with the representative’s written consent. The controller must protect the best interests of the child, and consent is invalid where processing endangers or harms those interests.
Informing Pupils and Parents at Collection
Article 24 defines the minimum information to be given before or at collection: the controller’s identity and contacts, and where they exist its representative and data protection officer; the purposes and legal basis; whether provision is mandatory and the consequences of refusal; recipients; planned transfers abroad; storage periods or their criteria; and the data subject’s rights.
A distinct requirement concerns form: where the data subject is a minor, the information must be given in simple, understandable language. Upon written request it must nonetheless be provided within 10 working days, and in special cases extended, with justification, by no more than 10 further working days, of which the data subject is notified immediately.