Breach Notification in Georgia

Breach Notification

To whom is the incident notification addressed?

The State Audit Service — under current legislation it exercises supervision in the field of data protection. The notification is given in writing or electronically no later than 72 hours from discovery, unless significant damage or threat is unlikely.

What must the notification contain?

Five elements: the circumstances, nature and time of the incident; the approximate categories and quantities of affected data and subjects; the likely damage and measures taken or planned; whether the organisation plans to inform the subjects and when; and contact details.

When must the data subject be informed?

Where the incident is likely to cause significant damage or threat to fundamental rights, the subject must be notified at the first opportunity without unjustified delay, in simple and comprehensible language. Where individual notification is disproportionate, public communication is possible.

What fine threatens for omission of the notification?

Failure to notify the State Audit Service entails a warning or a fine — up to 2 000 lari where annual turnover does not exceed 500 000 lari and up to 3 000 lari where it exceeds it; with aggravating circumstances — up to 3 000 and 5 000 lari respectively.

4 min·8 Feb 2026

About this service

A data incident — a security failure as a result of which data is accidentally or unlawfully destroyed, lost, altered, disclosed or accessed — is for an organisation not only a technical but a legal event. The Georgian law on personal data protection obliges the controller to record incidents and to give notice of them. One circumstance should be stated early: under the current legislation, supervision in the field of data protection is exercised by the State Audit Service, and the notification is addressed precisely to it — the title „inspector“ is a legacy of the old institution. This service helps organisations with the legal response to an incident: determining the obligations, preparing the notification and managing sanction risk.

Breach Notification

To whom is the incident notification addressed?

What must the notification contain?

When must the data subject be informed?

What fine threatens for omission of the notification?

4 min·8 Feb 2026

About this service