---
title: "Hosting Jurisdictions and Data Placement"
url: "https://legal.ge/en/service/media-entertainment-and-sports-law-en/hosting-jurisdictions-and-data-placement-en"
field: "Media, Entertainment & Sports Law"
description: "Hosting jurisdictions and data — Articles 34, 37, 38: representative, transfer guarantees, list revised every 3 years. Legal.ge."
updated: "2026-10-15"
publisher: "legal.ge"
---

# Hosting Jurisdictions and Data Placement

> Source: legal.ge, https://legal.ge/en/service/media-entertainment-and-sports-law-en/hosting-jurisdictions-and-data-placement-en

## The Legal Dimension of Hosting Architecture

The choice of hosting for a gaming platform is not a technical decision but a legal precondition: where the server is located and who is registered as the controller directly determines what the Law on Personal Data Protection demands. Georgian law builds two axes here: the Georgian connection of a controller registered abroad, and the procedure for transferring data abroad. The legal assessment of hosting jurisdictions is built precisely on these two axes.

In practical terms this means: before a jurisdiction is chosen, three questions must conditionally be asked — where is the controller registered, does it use technical means located in Georgia, and will data be transferred to another state. Each answer carries its own normative consequence.

## The Institute of the Special Representative

Article 34 provides: where a controller registered outside Georgia processes data using technical means located in Georgia, it is obliged, before processing, to appoint or determine a special representative in Georgia. The representative is registered under the procedure established by a normative act of the State Audit Service, and the decisive point is this: the right to process data arises for the controller only after the registration of the special representative.

The purpose of the institute is supervisory contact: the representative is obliged to comply with a demand and/or decision of the Auditor General towards it, and the data subject has the right to exercise his or her rights precisely through the representative. At the same time, appointing a representative does not release the controller from the obligation to respond to the Auditor General. Exceptions also exist: the obligation does not extend to persons based in European Union member states and to persons based in states recognised by the European Union as having adequate protection.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/media-entertainment-and-sports-law-en/hosting-jurisdictions-and-data-placement-en

### What is a special representative?

A contact of a foreign-registered controller appointed in Georgia; without its registration, processing through Georgian technical means does not begin.

### How is transfer to a state without guarantees done?

By the subject’s informed written consent, alongside other statutory grounds; the route of contractual guarantees requires a supervisory permit.

### Why is the list dynamic?

Because it is revised at least once every 3 years, and a state declared inadequate is removed from the list without retroactive force.

### Who is the exception?

Persons based in European Union member states and in states recognised by the European Union as having adequate protection.