---
title: "Data Processor Compliance"
url: "https://legal.ge/en/service/technology-and-digital-law-en/data-processor-compliance-en"
field: "Technology & Digital Law"
description: "Data processor compliance: status, mandatory duties, records and incident communication under Georgian law. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-23"
publisher: "legal.ge"
---

# Data Processor Compliance

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/data-processor-compliance-en

## Who is the processor

Under the definition of Article 3 of the Law on Personal Data Protection, the processor is a natural person, legal person or public institution that processes data for the controller or on its behalf. An important clarification: a natural person in an employment relationship with the controller is not considered a processor — the status concerns outsourcing, not one's own staff. International vocabulary often calls this role the "processor"; the Georgian statutory term is precisely the authorized person for processing, and that is the one used in legal analysis. The same article also defines an incident: a breach of data security that causes unlawful or accidental damage, loss, unauthorized disclosure, destruction, alteration, access to the data or other unauthorized processing.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/data-processor-compliance-en

### Does the processor differ from an employee?

Yes. A natural person in an employment relationship with the controller is not a processor — the status concerns processing transferred to a third party.

### Must the processor keep its own records?

Yes — under point 2 of Article 28: the parties' identities and contacts, types of processing, transfers and safeguards, security measures and incidents. Upon request it is submitted to the State Audit Service within 3 working days.

### How is an incident communicated?

The processor notifies the controller immediately — the 72-hour period for notifying the State Audit Service starts precisely here.

### May the mandate be transferred to another person?

Only with the controller's prior written consent — which does not release the processor from its obligations.

### What happens on termination of the agreement?

Processing stops and the processed data are transferred to the controller immediately and in full.