Why a data breach response plan is necessary
A data breach response plan is a document prepared in advance that defines who, when, within which deadlines and with which content responds to an incident. Unlike live response, which is the management of an event that has already happened, the plan is an ex-ante instrument: it is created when nothing has happened yet, so that decisions during a crisis are not the result of improvisation. The Georgian Law on Personal Data Protection does not separately require the existence of a plan, but every element of it rests on obligations established by law — and it is precisely the violation of those obligations that triggers the sanctions from which the plan protects.
The legal foundation of the plan rests on two pillars. The first is the security obligation: under the second paragraph of Article 27 of the law, the controller and the processor are obliged to adopt organisational and technical measures corresponding to the possible and accompanying risks, including pseudonymisation, logging of access and information-security mechanisms. The second is the set of incident-recording and notification obligations in Articles 29 and 30.
What the plan should reflect from the security baseline
The plan begins with a list of the measures established by Article 27 that will be activated during an incident: pseudonymisation of data, logging of access to data, and mechanisms of confidentiality, integrity and availability. The third paragraph of the same article requires the periodic assessment of the effectiveness of these measures — in the plan this should be reflected as an assessment schedule.
A separate emphasis falls on records. Under the fourth paragraph of Article 27, every action performed on data in electronic form, including information on incidents, is recorded. The plan defines who maintains the records during an incident and where the consequence that has occurred and the measures taken are fixed — because it is precisely this record that becomes the basis of the notification.