Who is the processor
Under the definition of Article 3 of the Law on Personal Data Protection, the processor is a natural person, legal person or public institution that processes data for the controller or on its behalf. An important clarification: a natural person in an employment relationship with the controller is not considered a processor — the status concerns outsourcing, not one's own staff. International vocabulary often calls this role the "processor"; the Georgian statutory term is precisely the authorized person for processing, and that is the one used in legal analysis. The same article also defines an incident: a breach of data security that causes unlawful or accidental damage, loss, unauthorized disclosure, destruction, alteration, access to the data or other unauthorized processing.
The basis of operation, mandatory conditions and security
Under point 1 of Article 36, the processor processes data only on the basis of a legal act or a written agreement with the controller defining the grounds and purposes of processing, the categories of data to be processed, the term and the parties' rights and duties. The agreement must also contain five mandatory conditions: processing only under the controller's documented instruction; confidentiality for the persons directly participating in the processing; security in accordance with the law; deletion or transfer of the data to the controller on termination or cessation of the agreement — including copies, unless their retention is required by Georgian legislation; and provision of information to the controller with support for its monitoring.
Further processing beyond the defined purposes is prohibited. Processing through a processor is permissible only where the processor ensures appropriate organizational and technical measures to protect the subject's rights and the law's requirements; and where, in view of the processor's activity or aims, a high risk of non-purposeful processing or violation of the subject's rights exists, concluding the agreement is itself prohibited. Transferring rights and duties to another person is possible only with the controller's prior written consent, which does not release from obligations; on the arising of a dispute the processing stops immediately and the data are transferred in full, and on termination of the agreement or the legal act the processed data must be transferred to the controller immediately and in full.
The controller, for its part, must request information in advance about the processing in accordance with the data law and monitor the processor's processing. Under point 10 of Article 36, the processor must take appropriate organizational-technical measures to help the controller perform duties connected with the exercise of the subject's rights — a subject's request must not fall between the organizations. Therefore, in every outsourcing plan, the scenario of both roles should be played out before the contract: who keeps the records, who notifies and how the exit from the relationship works.