The Legal Dimension of Hosting Architecture
The choice of hosting for a gaming platform is not a technical decision but a legal precondition: where the server is located and who is registered as the controller directly determines what the Law on Personal Data Protection demands. Georgian law builds two axes here: the Georgian connection of a controller registered abroad, and the procedure for transferring data abroad. The legal assessment of hosting jurisdictions is built precisely on these two axes.
In practical terms this means: before a jurisdiction is chosen, three questions must conditionally be asked — where is the controller registered, does it use technical means located in Georgia, and will data be transferred to another state. Each answer carries its own normative consequence.
The Institute of the Special Representative
Article 34 provides: where a controller registered outside Georgia processes data using technical means located in Georgia, it is obliged, before processing, to appoint or determine a special representative in Georgia. The representative is registered under the procedure established by a normative act of the State Audit Service, and the decisive point is this: the right to process data arises for the controller only after the registration of the special representative.
The purpose of the institute is supervisory contact: the representative is obliged to comply with a demand and/or decision of the Auditor General towards it, and the data subject has the right to exercise his or her rights precisely through the representative. At the same time, appointing a representative does not release the controller from the obligation to respond to the Auditor General. Exceptions also exist: the obligation does not extend to persons based in European Union member states and to persons based in states recognised by the European Union as having adequate protection.
The Procedure for Transferring Data
Article 37 regulates the transfer of data to another state and to an international organisation. The general rule is twofold: transfer is admissible if the processing requirements provided for by this law exist and the corresponding state or organisation ensures adequate guarantees of data protection and of the protection of the subject’s rights. Beyond this the law lists additional grounds: an international treaty or agreement; a contract by which the controller itself ensures adequate guarantees — such transfer is possible only after a permit of the State Audit Service; cases provided for by criminal procedure and law-enforcement cooperation legislation, by the law on the legal status of foreigners, and by anti-money-laundering legislation; the subject’s written consent given after receiving information about the absence of guarantees and possible threats in the destination state; vital interests; and a significant public interest where transfer is a necessary and proportionate measure.
In the hosting context the most operative block here is contractual guarantees: when players’ data moves to a foreign server or cloud region, the contract between the controller and the recipient must contain adequate guarantees, and such architecture demands a supervisory permit — this is the measure whose omission is fixed directly as a violation.
The Assessment of Adequate Guarantees
Article 38 determines who and how assesses adequate guarantees: the State Audit Service, on the basis of an analysis of international obligations and regulatory legislation, of guarantees for the protection of the subject’s rights and freedoms — including effective mechanisms of legal protection — of the rules for further international transfer of data, and of the existence, powers and activity of an independent supervisory authority.
The decisive detail is that the list of states and organisations where adequate guarantees are ensured is determined by a normative act of the Auditor General and is revised at least once every 3 years; if a state no longer satisfies the conditions, the list is amended without retroactive force. For a hosting team this means: a jurisdiction that is adequate today may drop off the list tomorrow, and the architecture must know this scenario in advance.
Frequently Asked Questions
When does the Georgian regulator begin controlling hosting?
When a controller registered abroad uses technical means located in Georgia — in that case the registration of a special representative is a precondition of processing.
What does transferring data to a foreign server require?
Observance of the law’s processing requirements and adequate guarantees of the recipient; the route of contractual guarantees requires a permit of the State Audit Service.
Who assesses the adequacy of a jurisdiction?
The State Audit Service, in the form of a list established by a normative act of the Auditor General, revised at least once every 3 years.
Does a representative release the foreign person?
No — it only creates supervisory contact; the obligation to respond to the Auditor General’s demands remains with the controller.
How We Help on Legal.ge
We will assess each layer of your hosting architecture through the prism of the data protection law, prepare the procedures of representative registration and transfer permits, and build contractual guarantees. Contact us on Legal.ge — server location is a decision best started legally.