What a data protection impact assessment is and which law governs it in Georgia
A data protection impact assessment is a prior, documented analysis through which the controller identifies, before launching a processing operation, what risks the planned processing creates for the fundamental rights and freedoms of individuals and what organisational and technical measures are needed to avoid or substantially reduce those risks. In Georgia this instrument exists not as a voluntary standard or a contractual practice but as a direct statutory duty: Article 31 of the Georgian Law on Personal Data Protection defines when, how and in which form the assessment must be carried out. That article is the anchor of your organisation's compliance position and of its administrative liability exposure.
In international practice this instrument is widely known by an abbreviation that spread from the European Union's general data protection regulation. It is important to keep the distinction clear: the operative norm in Georgian law is the Georgian Law on Personal Data Protection, which follows the European approach, while the EU regulation serves only as the comparative framework the Georgian law aligns with. Article 31 of the same law directly names the State Audit Office as the public body to be consulted where necessary, and the criteria for establishing the circumstances that trigger the assessment duty are set by a normative act of the General Auditor.
When the assessment becomes mandatory
Under the first paragraph of Article 31, where taking into account new technologies, the category of data, the volume, the purposes and the means of processing there is a high probability of a risk of violation of fundamental rights and freedoms, the controller is obliged to carry out a data protection impact assessment in advance. The assessment therefore precedes the planned processing; it is not a remedial exercise conducted after a breach has already occurred.
Beyond this general criterion, the second paragraph of Article 31 lists three situations in which the assessment is mandatory without any additional interpretation. First, where the controller makes a decision with legal, financial or other significantly important consequences for the data subject in a fully automated manner, including on the basis of profiling. Second, where it processes special categories of data of a large number of data subjects. Third, where it carries out systematic and large-scale monitoring of the behaviour of data subjects in public gathering places.
To prevent the notion of a large number from becoming a matter of subjective interpretation, the seventh paragraph of Article 31 sets a quantitative threshold: a large number of data subjects means not less than 3 percent of the population of Georgia, calculated according to the final results of the last census. In practical terms, if your processing touches special-category data at that scale, the assessment is mandatory. The criteria for establishing the circumstances giving rise to the assessment duty and the procedure for conducting it are established in detail by a normative act of the General Auditor, so the document must be reconciled with those acts before it is finalised.
Required content of the assessment document and its retention
A data protection impact assessment is not merely a technical conclusion or an internal memorandum. Under the third paragraph of Article 31 the controller is obliged to create a written document containing two closely connected blocks. The first is a description of the category of data, the purposes of their processing, proportionality, the process and the grounds. The second is an assessment of the possible risks of violation of fundamental rights and freedoms and a description of the organisational and technical measures envisaged for data security. The document thus answers simultaneously what you process, why, and with which risks.
The document also has a legally significant retention rule. Under the fourth paragraph of Article 31, where the processing process changes substantially the controller is obliged to update the assessment document, and the retention rule sets a clear orientation: the document is kept throughout the entire period of processing, and where processing ceases, for at least 1 year. This means that producing the document at the request of the supervisory authority cannot become a problem even for processing operations that have already been completed.