---
title: "Biometric Compliance"
url: "https://legal.ge/en/service/technology-and-digital-law-en/biometric-compliance-en"
field: "Technology & Digital Law"
description: "Biometric data is a special category under Georgian law: closed list of permitted bases, written determination and impact assessment. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-14"
publisher: "legal.ge"
---

# Biometric Compliance

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/biometric-compliance-en

## About this service

A facial image, a fingerprint, a voice characteristic, an iris pattern — biometric data is the strongest means of identifying a person and at the same time one of the most sensitive categories of data. A leak of biometrics cannot be fixed by changing a password: biometrics accompanies a person for life. That is precisely why the Georgian law on personal data protection places biometric data in the special-category regime and subjects its processing to special conditions. This service helps organisations that use — or plan to use — biometrics, from access control to customer verification.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/biometric-compliance-en

### What is biometric data?

Data processed by technical means, connected to physical, physiological or behavioural characteristics, enabling a person's unique identification or identity confirmation. The special-category regime applies where the purpose is unique identification.

### Can biometrics be used for convenience?

Convenience is not a lawful basis. Biometric processing for activity, security, property protection and secrecy is permitted only where achieving these purposes by other means is impossible or disproportionately costly — biometrics must be the last resort.

### What document must exist before the system is switched on?

A written determination: the purpose and scope of processing, retention period, storage and destruction procedure and rights-protection mechanisms. It must exist before the processing begins.

### When is an impact assessment needed?

Where new technologies create a high probability of risk to rights and, additionally, in cases of systematic large-scale monitoring of behaviour. The document is kept during processing and for at least 1 year after its cessation.