The Legal Dimension of Hosting Architecture
The choice of hosting for a gaming platform is not a technical decision but a legal precondition: where the server is located and who is registered as the controller directly determines what the Law on Personal Data Protection demands. Georgian law builds two axes here: the Georgian connection of a controller registered abroad, and the procedure for transferring data abroad. The legal assessment of hosting jurisdictions is built precisely on these two axes.
In practical terms this means: before a jurisdiction is chosen, three questions must conditionally be asked — where is the controller registered, does it use technical means located in Georgia, and will data be transferred to another state. Each answer carries its own normative consequence.
The Institute of the Special Representative
Article 34 provides: where a controller registered outside Georgia processes data using technical means located in Georgia, it is obliged, before processing, to appoint or determine a special representative in Georgia. The representative is registered under the procedure established by a normative act of the State Audit Service, and the decisive point is this: the right to process data arises for the controller only after the registration of the special representative.
The purpose of the institute is supervisory contact: the representative is obliged to comply with a demand and/or decision of the Auditor General towards it, and the data subject has the right to exercise his or her rights precisely through the representative. At the same time, appointing a representative does not release the controller from the obligation to respond to the Auditor General. Exceptions also exist: the obligation does not extend to persons based in European Union member states and to persons based in states recognised by the European Union as having adequate protection.