Why Player Data Is a Central Risk for Operators
A gambling operator begins nearly every relationship with data: player registration, identification and verification, the history of deposits and withdrawals, the behavioural profile of play, checks against self-exclusion and prohibited-person lists — all of this is the processing of personal data. Article 2 of the Law of Georgia on Personal Data Protection defines the scope of the law: it applies to the processing of data by automatic and semi-automatic means, to the non-automatic processing of data that forms part of a filing system or is intended to be included in one, and to the processing, by a controller registered outside Georgia, carried out using technical means located in Georgia — except where such means are used only for the transit of data.
This means that even an operator operating through a foreign structure, but using Georgian servers or other technical means, falls within the effective zone of Georgian law. At the same time, the law does not apply to processing for personal or family purposes, for state security, defence and intelligence purposes, to court proceedings, or to the activities of mass media — but commercial gambling activity does not fit within those exceptions.