What cross-border data transfer means under Georgian law
Cross-border data transfer means the transfer of data to another state or to an international organisation, and this process is governed by Articles 37 and 38 of the Georgian Law on Personal Data Protection. This page discusses the complete algorithm of the lawfulness of a transfer: from the general requirements, through the permitted grounds and the restrictions on onward transfers, to the adequacy assessment and the sanctions provided for violations.
The initial rule is simple but often omitted: before a transfer, the processing itself must satisfy the general requirements of the law, including the existence of a ground defined in Article 5. A transfer is not an isolated technical act — it is a continuation of processing, which is precisely why it requires the same legal foundation as any other processing.
The general rule: states with appropriate guarantees
Under the first paragraph of Article 37, the transfer of data to another state and to an international organisation is admissible where the requirements provided for by this law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state or international organisation. The list of states and organisations where such guarantees exist is determined, under the second paragraph of Article 38, by a normative act of the General Auditor.
The first paragraph of Article 38 provides that the existence of guarantees in the corresponding state is assessed by the State Audit Office on the basis of an analysis of international obligations, regulatory legislation, guarantees for the protection of the subject's rights, rules for further international transfer, and the existence, powers and activity of an independent supervisory authority. The list must be reviewed at least once every 3 years, and changes to it have no retroactive effect.
Exceptional grounds for transfer
Where the recipient country is not on the list, the second paragraph of Article 37 names six exceptional grounds. Transfer is admissible where: it is provided for by an international treaty or agreement of Georgia; the controller ensures appropriate guarantees by a contract concluded with the corresponding state, its competent public agency, a legal or natural person or an international organisation; it is provided for by the Criminal Procedure Code or by the relevant laws on international cooperation; the subject gives written consent after receiving information on the absence of guarantees and the possible risks; the transfer is necessary for vital interests where the subject is incapable of giving consent; or a significant public interest exists and the transfer is a necessary and proportionate measure.
The contract-based guarantees ground is particularly important for commercial practice. In that case the transfer is possible only after obtaining the permission of the State Audit Office, the procedure for which is established by a normative act of the General Auditor. The agreement must contain binding conditions with mandatory legal force that are enforceable.
Security measures and onward transfer
Under the fourth paragraph of Article 37, in any transfer on a permitted ground the controller or the processor is obliged to adopt the organisational and technical measures necessary for the secure transfer of the data. This requirement is independent of the ground on which the transfer takes place.
The rule on onward transfer is also strictly defined: the further transfer of data transferred to another state or international organisation to a third party is admissible only where it serves the original purposes and satisfies the grounds and appropriate guarantees provided for by that article. This is how control over the subsequent circulation of data is extended across the entire chain.
Liability for violating the rules
Article 85 of the law attaches an administrative sanction to transfer in violation of the rules established by Article 37. In the general case this act entails, for a natural person, a public agency, a non-commercial legal entity, a legal entity, a branch of an enterprise of a foreign country and an individual entrepreneur whose annual turnover does not exceed 500 000 lari, a warning or a fine of 2 000 lari; where the turnover exceeds 500 000 lari, a warning or a fine of 4 000 lari. With aggravating circumstances the fine rises to 4 000 and 6 000 lari.
The Legal.ge team will help you assess the lawfulness of a cross-border transfer: from checking the status of the recipient country, through selecting the ground and preparing contract conditions, to accompanying the State Audit Office permission process.
Frequently asked questions
Who assesses the adequacy of guarantees in another state?
The State Audit Service; the list of respective states is determined by a normative act of the Auditor General and is reviewed at least once every 3 years.
What fine follows a violation of the transfer rules?
For a person with annual turnover up to 500 000 lari — a warning or a fine of 2 000 lari; above that — a warning or 4 000 lari; with aggravating circumstances — 4 000 and 6 000 lari respectively.
Does a transfer require permission?
A transfer on the basis of contractual guarantees is possible only after obtaining the permission of the State Audit Service.
How We Help on Legal.ge
The lawyers of Legal.ge assess the ground of your transfer, draft the guarantees agreement, prepare the documentation for the State Audit Service and protect your interests before the supervisory authority.