Who is the processor
Under the definition of Article 3 of the Law on Personal Data Protection, the processor is a natural person, legal person or public institution that processes data for the controller or on its behalf. An important clarification: a natural person in an employment relationship with the controller is not considered a processor — the status concerns outsourcing, not one's own staff. International vocabulary often calls this role the "processor"; the Georgian statutory term is precisely the authorized person for processing, and that is the one used in legal analysis. The same article also defines an incident: a breach of data security that causes unlawful or accidental damage, loss, unauthorized disclosure, destruction, alteration, access to the data or other unauthorized processing.