---
title: "EdTech Compliance"
url: "https://legal.ge/en/service/corporate-and-commercial-law-en/edtech-compliance-en"
field: "Corporate & Commercial Law"
description: "EdTech compliance in Georgia: pupil data, the age-16 consent threshold, parental consent, security and the 72-hour incident rule. Legal.ge."
reviewed: "2026-07-09"
updated: "2026-11-08"
publisher: "legal.ge"
---

# EdTech Compliance

> Source: legal.ge, https://legal.ge/en/service/corporate-and-commercial-law-en/edtech-compliance-en

Educational technology platforms process the personal data of minors every day: names, ages, contact details, learning results and behavioural statistics. In Georgian law this relationship is governed by the Law of Georgia on Personal Data Protection, which contains a dedicated regime for minors. This page examines what the statute requires of an educational platform — from the lawful basis of each operation to the 72-hour incident notification — and marks the deliberate boundary of the discussion: the status, authorisation and curriculum regulation of educational institutions form a separate legislative sphere whose norms we do not cite here.

## Principles and Lawful Bases of Processing

Article 4 sets the principles binding every controller: data must be processed lawfully, fairly and transparently for the pupil and without violating their dignity; collected only for specific, clearly defined and legitimate purposes; processed only to the extent necessary; kept accurate; stored no longer than necessary; and protected by appropriate technical and organisational measures.

Article 5 requires every operation to rest on a lawful basis: consent, a contract with the pupil or steps at their request, a legal provision, a legal obligation, publicly available data, vital interests, a significant public interest or legitimate interests. For a platform this means every function — registration, analytics, communication — must be mapped in advance to its basis, and the burden of substantiation lies on the controller.

## The Age of the Pupil and the Consent Regime

The central rule for minors is Article 7: processing of a minor’s data on the basis of consent is permitted if the minor has reached the age of 16, while data of a minor under 16 may be processed with the consent of a parent or other legal representative. The law also contemplates cases where the consent of both a minor between 16 and 18 and the representative is required.

The platform must take reasonable and adequate measures to verify that the consent of the parent or representative of a pupil under 16 exists. Special categories of a minor’s data may be processed only with the representative’s written consent. The controller must protect the best interests of the child, and consent is invalid where processing endangers or harms those interests.

## Informing Pupils and Parents at Collection

Article 24 defines the minimum information to be given before or at collection: the controller’s identity and contacts, and where they exist its representative and data protection officer; the purposes and legal basis; whether provision is mandatory and the consequences of refusal; recipients; planned transfers abroad; storage periods or their criteria; and the data subject’s rights.

A distinct requirement concerns form: where the data subject is a minor, the information must be given in simple, understandable language. Upon written request it must nonetheless be provided within 10 working days, and in special cases extended, with justification, by no more than 10 further working days, of which the data subject is notified immediately.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/corporate-and-commercial-law-en/edtech-compliance-en

### Whose consent is required for processing a pupil’s personal data?

From the age of 16 the pupil consents personally; below 16 the consent of a parent or legal representative is required, and special categories of data need written consent. The platform must take reasonable measures to verify the representative’s consent.

### How must an educational platform secure pupil data?

Article 27 requires technical and organisational measures — pseudonymisation, access logging, information security mechanisms — and confidentiality obligations for staff that survive the end of employment.

### What is the deadline for notifying a data incident?

The incident must be recorded and notified to the State Audit Service no later than 72 hours from discovery, with categories of data, measures taken and a contact person, unless significant harm is unlikely.

### When is an impact assessment mandatory?

When processing children’s data using new technologies creates a high risk to fundamental rights. The document is kept for the whole processing period and at least 1 year after its termination.