Why a data breach response plan is necessary
A data breach response plan is a document prepared in advance that defines who, when, within which deadlines and with which content responds to an incident. Unlike live response, which is the management of an event that has already happened, the plan is an ex-ante instrument: it is created when nothing has happened yet, so that decisions during a crisis are not the result of improvisation. The Georgian Law on Personal Data Protection does not separately require the existence of a plan, but every element of it rests on obligations established by law — and it is precisely the violation of those obligations that triggers the sanctions from which the plan protects.
The legal foundation of the plan rests on two pillars. The first is the security obligation: under the second paragraph of Article 27 of the law, the controller and the processor are obliged to adopt organisational and technical measures corresponding to the possible and accompanying risks, including pseudonymisation, logging of access and information-security mechanisms. The second is the set of incident-recording and notification obligations in Articles 29 and 30.