---
title: "Unauthorized Access to Personal Data Defense"
url: "https://legal.ge/en/service/crim-criminal-law-en/unauthorized-access-to-personal-data-defense-en"
field: "Criminal Law"
description: "Article 284 CC Georgia: unauthorized access to personal data systems — fine to imprisonment up to 6 years. Lawyer review. Legal.ge."
reviewed: "2026-07-09"
updated: "2026-11-03"
publisher: "legal.ge"
---

# Unauthorized Access to Personal Data Defense

> Source: legal.ge, https://legal.ge/en/service/crim-criminal-law-en/unauthorized-access-to-personal-data-defense-en

## Unauthorized Access to Personal Data and Criminal Liability

In the modern world the overwhelming majority of personal data is stored in computer systems — databases, corporate servers, cloud services and other online environments. That is why entering such a system without authorization is treated as a crime under the Criminal Code of Georgia, namely Article 284. If this charge has been brought against you, or if your organization's system has become the object of such conduct, it is important to assess the exact legal boundaries of what happened. Below we set out in detail what the article covers, which penalties attach to each of its parts, and on which circumstances the outcome of the case depends.

## What the Elements of the Offense Include

The first part of the article prohibits unauthorized access to a computer system. This formula is strictly interpreted through the notes to the corresponding chapter of the Code, and it is those definitions that determine which conduct attracts liability:

-   the concept of a computer system is broad: it is any device or mechanism, or a group of interconnected devices or mechanisms, which automatically processes data by means of a program; under the law this concept covers a personal computer, any device with a microprocessor, and even a mobile telephone;
-   computer data is information in any form convenient for processing in the system — including a program that ensures the system's functioning; inventories of personal data typically fall squarely within this category;
-   unauthorized means unlawful, and also the situation where the holder of the right has not transferred the right to the person committing the act, directly or indirectly.

From these definitions it follows that one of the central questions of any case is whether the particular person had the right to enter the system. Where such a right existed — whether granted directly or indirectly — this element does not characterize the conduct as criminal. For a lawyer, one of the first tasks is therefore to reconstruct the history of access rights and to support it with documentary evidence.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/crim-criminal-law-en/unauthorized-access-to-personal-data-defense-en

### How is the offense formulated under Article 284?

The crime is unauthorized access to a computer system. The concept of a computer system covers a personal computer, any device with a microprocessor, and even a mobile telephone.

### Which penalty applies to the basic composition?

A fine, or corrective labor for a term of up to two years, or imprisonment for a term of up to two years.

### What happens in cases of significant damage or repetition?

The second part then applies: a fine or corrective labor for up to two years, or imprisonment from two to five years. Significant damage is damage exceeding 2000 GEL, except for a case provided for by another norm of the Code.

### When does the penalty reach its maximum?

When the conduct is committed against a subject of a critical information system — then the penalty is imprisonment for a term of three to six years.

### What does a lawyer examine in such a case?

The existence of access rights, the concepts of the system and the data, the damage calculation, the aggravating features, and the lawfulness of the evidence. Each of these directions reflects directly on the outcome.