---
title: "Data Breach Response"
url: "https://legal.ge/en/service/technology-and-digital-law-en/data-breach-response-en"
field: "Technology & Digital Law"
description: "Data breach response in Georgia: the incident definition, the 72-hour notification deadline and the rules for informing subjects. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-14"
publisher: "legal.ge"
---

# Data Breach Response

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/data-breach-response-en

## What counts as an incident under Georgian legislation

Data breach response in Georgia rests on the norms of the Law on Personal Data Protection, and the first question to answer is the definition of an incident. The relevant subparagraph of Article 3 of the law defines an incident as a violation of data security which entails the unlawful or accidental damage or loss of data, as well as unauthorised disclosure, destruction, alteration, access to them, their collection or other unauthorised processing. This definition is broad: it is not limited to a hacker attack and covers cases such as accidental deletion, a file sent to the wrong address or unauthorised access to a database.

When such an event occurs, the law prescribes for the controller a clear sequence of legal actions: the baseline of security measures, the recording of the incident, notification to the State Audit Office and, where necessary, informing the data subjects. Each of these stages is examined in detail below.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/data-breach-response-en

### What is an incident under data protection legislation?

A violation of data security entailing unlawful or accidental damage or loss of data, as well as unauthorised disclosure, destruction, alteration, access, collection or other unauthorised processing. The definition is not limited to hacker attacks.

### Within what period must the State Audit Office be notified?

No later than 72 hours from detection, in writing or electronically, unless significant damage or threat to fundamental rights is unlikely. The notification covers the circumstances, the categories and volume of data, the damage, the measures and the contact person.

### When are data subjects informed?

Where the incident is highly likely to cause significant damage or threat — at the first opportunity after detection, in simple language. Exceptions are a threat to protected interests and the case where security measures averted the significant threat.

### What role does the processor play?

It must notify the controller of the incident immediately, since the duty to notify within 72 hours rests precisely on the controller.