What counts as an incident under Georgian legislation
Data breach response in Georgia rests on the norms of the Law on Personal Data Protection, and the first question to answer is the definition of an incident. The relevant subparagraph of Article 3 of the law defines an incident as a violation of data security which entails the unlawful or accidental damage or loss of data, as well as unauthorised disclosure, destruction, alteration, access to them, their collection or other unauthorised processing. This definition is broad: it is not limited to a hacker attack and covers cases such as accidental deletion, a file sent to the wrong address or unauthorised access to a database.
When such an event occurs, the law prescribes for the controller a clear sequence of legal actions: the baseline of security measures, the recording of the incident, notification to the State Audit Office and, where necessary, informing the data subjects. Each of these stages is examined in detail below.
Security measures as the starting position
Response to an incident is assessed in the context of the measures the organisation has under Article 27 of the law. The controller and the processor are obliged to adopt organisational and technical measures corresponding to the possible and accompanying risks — including pseudonymisation of data, logging of access to data and information-security mechanisms — which ensure protection against loss and unlawful processing. The effectiveness of the measures is assessed periodically.
Article 27 also requires the recording of every action performed on data in electronic form — information on incidents, collection, alteration, access, disclosure, combination and deletion. When an incident occurs, it is precisely this record that becomes the source of the evidence used by the notification and the internal analysis.
Notification to the State Audit Office: deadline and content
Under the first paragraph of Article 29, the controller is obliged to record the incident, its consequence and the measures taken, and to notify the State Audit Office in writing or electronically no later than 72 hours from the detection of the incident. The only exception is where it is unlikely that the incident will cause significant damage or pose a significant threat to human fundamental rights and freedoms.
The content of the notification is defined by law: the circumstances, nature and time of the incident; the estimated categories and volume of data damaged, disclosed or lost, and the estimated circle of affected subjects; the estimated damage and the measures carried out or planned; the intention regarding informing the subjects; and the contact person's details. Where providing the information together and in full is impossible, it may be submitted in stages in agreement with the State Audit Office. Where processing is carried out through a processor, the latter is obliged to notify the controller of the incident immediately.
The publicity aspect should also be noted: where the controller fails to inform the subjects, the State Audit Office is entitled to make the information about the incident public — except where publication would endanger state security, cybersecurity, investigation or other legally protected interests, or where the institution requests non-disclosure on a legally established ground.