What cross-border data transfer means under Georgian law
Cross-border data transfer means the transfer of data to another state or to an international organisation, and this process is governed by Articles 37 and 38 of the Georgian Law on Personal Data Protection. This page discusses the complete algorithm of the lawfulness of a transfer: from the general requirements, through the permitted grounds and the restrictions on onward transfers, to the adequacy assessment and the sanctions provided for violations.
The initial rule is simple but often omitted: before a transfer, the processing itself must satisfy the general requirements of the law, including the existence of a ground defined in Article 5. A transfer is not an isolated technical act — it is a continuation of processing, which is precisely why it requires the same legal foundation as any other processing.
The general rule: states with appropriate guarantees
Under the first paragraph of Article 37, the transfer of data to another state and to an international organisation is admissible where the requirements provided for by this law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state or international organisation. The list of states and organisations where such guarantees exist is determined, under the second paragraph of Article 38, by a normative act of the General Auditor.
The first paragraph of Article 38 provides that the existence of guarantees in the corresponding state is assessed by the State Audit Office on the basis of an analysis of international obligations, regulatory legislation, guarantees for the protection of the subject's rights, rules for further international transfer, and the existence, powers and activity of an independent supervisory authority. The list must be reviewed at least once every 3 years, and changes to it have no retroactive effect.