Legal.GeLegal.Ge
Data Breach Management

Breach Notification

To whom is the incident notification addressed?

The State Audit Service — under current legislation it exercises supervision in the field of data protection. The notification is given in writing or electronically no later than 72 hours from discovery, unless significant damage or threat is unlikely.

What must the notification contain?

Five elements: the circumstances, nature and time of the incident; the approximate categories and quantities of affected data and subjects; the likely damage and measures taken or planned; whether the organisation plans to inform the subjects and when; and contact details.

When must the data subject be informed?

Where the incident is likely to cause significant damage or threat to fundamental rights, the subject must be notified at the first opportunity without unjustified delay, in simple and comprehensible language. Where individual notification is disproportionate, public communication is possible.

What fine threatens for omission of the notification?

Failure to notify the State Audit Service entails a warning or a fine — up to 2 000 lari where annual turnover does not exceed 500 000 lari and up to 3 000 lari where it exceeds it; with aggravating circumstances — up to 3 000 and 5 000 lari respectively.

4 min·8 Feb 2026

About this service

A data incident — a security failure as a result of which data is accidentally or unlawfully destroyed, lost, altered, disclosed or accessed — is for an organisation not only a technical but a legal event. The Georgian law on personal data protection obliges the controller to record incidents and to give notice of them. One circumstance should be stated early: under the current legislation, supervision in the field of data protection is exercised by the State Audit Service, and the notification is addressed precisely to it — the title „inspector“ is a legacy of the old institution. This service helps organisations with the legal response to an incident: determining the obligations, preparing the notification and managing sanction risk.

The notification duty — 72 hours

Article 29 of the law sets the basic rule: the controller is obliged to record the incident, its consequences and the measures taken, and to notify the State Audit Service in writing or electronically no later than 72 hours from the discovery of the incident — except where it is unlikely that the incident will cause significant damage or pose a significant threat to human fundamental rights and freedoms. The hours thus run from the moment of discovery, not from the completion of a full investigation — a distinction that is decisive in practice. Moreover, where it is impossible to provide all the required information at once, the controller may, in agreement with the State Audit Service, supply the information in stages within a reasonable period.

What the notification must contain

The law describes the content precisely. The notification must contain: information on the circumstances, nature and time of the incident; the approximate categories and quantities of data unlawfully disclosed, damaged, deleted, destroyed, obtained, lost or altered, and of the data subjects placed at risk; the likely damage caused by the incident and the measures carried out or planned to reduce or eliminate it; whether the controller plans to notify the data subjects and within what period; and the details of the data protection officer or other contact person. These five elements are the minimum without which a notification is considered incomplete.

Updated: 12 Nov 2026

Related Services

Data Breach Response PlanningBreach RemediationData Breach Response