What a data protection impact assessment is and which law governs it in Georgia
A data protection impact assessment is a prior, documented analysis through which the controller identifies, before launching a processing operation, what risks the planned processing creates for the fundamental rights and freedoms of individuals and what organisational and technical measures are needed to avoid or substantially reduce those risks. In Georgia this instrument exists not as a voluntary standard or a contractual practice but as a direct statutory duty: Article 31 of the Georgian Law on Personal Data Protection defines when, how and in which form the assessment must be carried out. That article is the anchor of your organisation's compliance position and of its administrative liability exposure.
In international practice this instrument is widely known by an abbreviation that spread from the European Union's general data protection regulation. It is important to keep the distinction clear: the operative norm in Georgian law is the Georgian Law on Personal Data Protection, which follows the European approach, while the EU regulation serves only as the comparative framework the Georgian law aligns with. Article 31 of the same law directly names the State Audit Office as the public body to be consulted where necessary, and the criteria for establishing the circumstances that trigger the assessment duty are set by a normative act of the General Auditor.