---
title: "Data Processing Agreements"
url: "https://legal.ge/en/service/technology-and-digital-law-en/data-processing-agreements-97-en"
field: "Technology & Digital Law"
description: "Data processing agreements in Georgia: monitoring, sub-processors, exit rules and fines up to 4 000 lari under Article 84. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-15"
publisher: "legal.ge"
---

# Data Processing Agreements

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/data-processing-agreements-97-en

## The data processing agreement: what happens after signing

A data processing agreement shapes the legal link between the controller and the processor. Under the first paragraph of Article 36 of the Georgian Law on Personal Data Protection, a processor may process data only on the basis of a legal act or a written agreement which defines the grounds and purposes of processing, the categories of data to be processed, the term of processing and the rights and obligations of the parties. The focus of this page, however, is not the text of the agreement but its lifecycle: what obligations the parties bear while the agreement operates, in disputes and upon its termination.

The law distributes clear roles here. The processor processes data only in accordance with the controller's written assignment or instruction; it ensures that the natural person directly involved in processing has a duty of confidentiality; it ensures the security of data in accordance with the law; and upon cancellation or termination of the agreement it deletes the data or transfers them to the controller and deletes the copies, unless their retention is required by legislation. Further processing of the data for a purpose different from that defined by the agreement or legal act is inadmissible.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/data-processing-agreements-97-en

### What must a data processing agreement define?

Under Article 36: the grounds and purposes of processing, the categories of data, the term of processing and the rights and obligations of the parties. The processor processes data only under a written assignment, and changing the purpose is inadmissible.

### May data be passed to a sub-processor?

Only with the controller's prior written consent. The consent does not release the processor from its obligations and liability.

### What happens in a dispute or at the end of the agreement?

Upon a dispute the processor immediately ceases processing and transfers all data to the controller in full. Upon cancellation or termination, processing ceases and the data are transferred immediately and in full.

### What fine is provided?

Under Article 84: a warning or a fine of 1 000 lari where turnover does not exceed 500 000 lari and a warning or a fine of 2 000 lari above that threshold; with aggravating circumstances, 2 000 and 4 000 lari.