Software-as-a-service platforms that process customer data in the cloud usually frame compliance through international certification schemes. Georgian law knows no such certification statute: compliance here means fulfilling — and being able to demonstrate fulfilment of — the specific obligations of the Law of Georgia on Personal Data Protection. That statute builds the auditable framework on which a service provider stands: security measures, records of processing, incident notification, impact assessment and, where thresholds are met, the data protection officer. On this page the lawyers of Legal.ge explain each element of that framework, article by article, as it applies to a platform business.
Principles and Lawful Bases
Article 4 sets the principles: data must be processed lawfully, fairly and transparently; collected for specific, clearly defined purposes; processed only to the extent necessary; kept accurate; stored only as long as needed; and protected by technical and organisational measures. The controller is responsible for compliance with these principles and must be able to substantiate it.
Article 5 lists the lawful bases: the subject’s consent, performance of a contract or steps at the subject’s request, processing provided by law, legal obligations, publicly available data, vital interests, significant public interest and legitimate interests. For a platform this means each function — account creation, analytics, support — is mapped in advance to a specific basis, and that mapping is documented rather than assumed.