Software-as-a-service platforms that process customer data in the cloud usually frame compliance through international certification schemes. Georgian law knows no such certification statute: compliance here means fulfilling — and being able to demonstrate fulfilment of — the specific obligations of the Law of Georgia on Personal Data Protection. That statute builds the auditable framework on which a service provider stands: security measures, records of processing, incident notification, impact assessment and, where thresholds are met, the data protection officer. On this page the lawyers of Legal.ge explain each element of that framework, article by article, as it applies to a platform business.
Principles and Lawful Bases
Article 4 sets the principles: data must be processed lawfully, fairly and transparently; collected for specific, clearly defined purposes; processed only to the extent necessary; kept accurate; stored only as long as needed; and protected by technical and organisational measures. The controller is responsible for compliance with these principles and must be able to substantiate it.
Article 5 lists the lawful bases: the subject’s consent, performance of a contract or steps at the subject’s request, processing provided by law, legal obligations, publicly available data, vital interests, significant public interest and legitimate interests. For a platform this means each function — account creation, analytics, support — is mapped in advance to a specific basis, and that mapping is documented rather than assumed.
Security Measures and Records — the Auditable Core
Article 27 requires appropriate technical and organisational measures and the ability to demonstrate compliance: pseudonymisation, logging of access to data, information security mechanisms covering confidentiality, integrity and availability, records of every operation performed on electronic data, and staff confidentiality that survives the end of employment.
Article 28 adds the documentary layer that makes an audit meaningful: the controller and its representative record, in writing or electronically, identities and contacts, purposes of processing, categories of subjects and data, recipients, transfers to other states, retention periods, security measures and incidents. That information must be provided to the State Audit Service upon request immediately, but no later than 3 working days — a deadline that is practically impossible to meet without a maintained register. Preparing that register before the first request is therefore not diligence but basic risk management.