What counts as an incident under Georgian legislation
Data breach response in Georgia rests on the norms of the Law on Personal Data Protection, and the first question to answer is the definition of an incident. The relevant subparagraph of Article 3 of the law defines an incident as a violation of data security which entails the unlawful or accidental damage or loss of data, as well as unauthorised disclosure, destruction, alteration, access to them, their collection or other unauthorised processing. This definition is broad: it is not limited to a hacker attack and covers cases such as accidental deletion, a file sent to the wrong address or unauthorised access to a database.
When such an event occurs, the law prescribes for the controller a clear sequence of legal actions: the baseline of security measures, the recording of the incident, notification to the State Audit Office and, where necessary, informing the data subjects. Each of these stages is examined in detail below.