---
title: "Cross-Border Data Transfers"
url: "https://legal.ge/en/service/technology-and-digital-law-en/cross-border-data-transfers-en"
field: "Technology & Digital Law"
description: "Cross-border transfers under Articles 37-38 of the Georgian data protection law: grounds, permission and fines up to 6 000 lari. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-14"
publisher: "legal.ge"
---

# Cross-Border Data Transfers

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/cross-border-data-transfers-en

## What cross-border data transfer means under Georgian law

Cross-border data transfer means the transfer of data to another state or to an international organisation, and this process is governed by Articles 37 and 38 of the Georgian Law on Personal Data Protection. This page discusses the complete algorithm of the lawfulness of a transfer: from the general requirements, through the permitted grounds and the restrictions on onward transfers, to the adequacy assessment and the sanctions provided for violations.

The initial rule is simple but often omitted: before a transfer, the processing itself must satisfy the general requirements of the law, including the existence of a ground defined in Article 5. A transfer is not an isolated technical act — it is a continuation of processing, which is precisely why it requires the same legal foundation as any other processing.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/cross-border-data-transfers-en

### When is the transfer of data to another country admissible?

Where the processing satisfies the requirements of the law and appropriate guarantees of data protection are ensured in the recipient state. The list of such states is determined by a normative act of the General Auditor.

### What if the country is not on the list?

Six exceptional grounds apply: an international treaty, contractual guarantees (with State Audit Office permission), law-enforcement laws, informed written consent, vital interests or significant public interest.

### May received data be transferred onwards?

Only where the onward transfer serves the original purposes and satisfies the same grounds and appropriate guarantees.

### What fine is provided?

Under Article 85: a warning or a fine of 2 000 lari where turnover does not exceed 500 000 lari and a warning or a fine of 4 000 lari above that threshold; with aggravating circumstances, 4 000 and 6 000 lari.