---
title: "Data Protection Impact Assessments"
url: "https://legal.ge/en/service/technology-and-digital-law-en/data-protection-impact-assessments-en"
field: "Technology & Digital Law"
description: "Article 31 of the Georgian data protection law: mandatory impact assessment, its document, and fines from 2 000 to 5 000 lari. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Data Protection Impact Assessments

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/data-protection-impact-assessments-en

## What a data protection impact assessment is and which law governs it in Georgia

A data protection impact assessment is a prior, documented analysis through which the controller identifies, before launching a processing operation, what risks the planned processing creates for the fundamental rights and freedoms of individuals and what organisational and technical measures are needed to avoid or substantially reduce those risks. In Georgia this instrument exists not as a voluntary standard or a contractual practice but as a direct statutory duty: Article 31 of the Georgian Law on Personal Data Protection defines when, how and in which form the assessment must be carried out. That article is the anchor of your organisation's compliance position and of its administrative liability exposure.

In international practice this instrument is widely known by an abbreviation that spread from the European Union's general data protection regulation. It is important to keep the distinction clear: the operative norm in Georgian law is the Georgian Law on Personal Data Protection, which follows the European approach, while the EU regulation serves only as the comparative framework the Georgian law aligns with. Article 31 of the same law directly names the State Audit Office as the public body to be consulted where necessary, and the criteria for establishing the circumstances that trigger the assessment duty are set by a normative act of the General Auditor.

## When the assessment becomes mandatory

Under the first paragraph of Article 31, where taking into account new technologies, the category of data, the volume, the purposes and the means of processing there is a high probability of a risk of violation of fundamental rights and freedoms, the controller is obliged to carry out a data protection impact assessment in advance. The assessment therefore precedes the planned processing; it is not a remedial exercise conducted after a breach has already occurred.

Beyond this general criterion, the second paragraph of Article 31 lists three situations in which the assessment is mandatory without any additional interpretation. First, where the controller makes a decision with legal, financial or other significantly important consequences for the data subject in a fully automated manner, including on the basis of profiling. Second, where it processes special categories of data of a large number of data subjects. Third, where it carries out systematic and large-scale monitoring of the behaviour of data subjects in public gathering places.

To prevent the notion of a large number from becoming a matter of subjective interpretation, the seventh paragraph of Article 31 sets a quantitative threshold: a large number of data subjects means not less than 3 percent of the population of Georgia, calculated according to the final results of the last census. In practical terms, if your processing touches special-category data at that scale, the assessment is mandatory. The criteria for establishing the circumstances giving rise to the assessment duty and the procedure for conducting it are established in detail by a normative act of the General Auditor, so the document must be reconciled with those acts before it is finalised.

## Required content of the assessment document and its retention

A data protection impact assessment is not merely a technical conclusion or an internal memorandum. Under the third paragraph of Article 31 the controller is obliged to create a written document containing two closely connected blocks. The first is a description of the category of data, the purposes of their processing, proportionality, the process and the grounds. The second is an assessment of the possible risks of violation of fundamental rights and freedoms and a description of the organisational and technical measures envisaged for data security. The document thus answers simultaneously what you process, why, and with which risks.

The document also has a legally significant retention rule. Under the fourth paragraph of Article 31, where the processing process changes substantially the controller is obliged to update the assessment document, and the retention rule sets a clear orientation: the document is kept throughout the entire period of processing, and where processing ceases, for at least 1 year. This means that producing the document at the request of the supervisory authority cannot become a problem even for processing operations that have already been completed.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/data-protection-impact-assessments-en

### When is a data protection impact assessment mandatory?

Under Article 31 of the Law on Personal Data Protection, the assessment is mandatory where, taking into account new technologies, the category, volume, purposes and means of processing, a risk of violation of fundamental rights is highly probable. It is also mandatory for fully automated decisions with significant consequences, processing of large volumes of special-category data, and systematic large-scale monitoring in public gathering places. A large number means not less than 3 percent of the population.

### What must the assessment document contain?

The document is written and contains two parts: a description of the data category, processing purposes, proportionality, process and grounds, and an assessment of possible risks with a description of organisational and technical security measures. It is kept throughout the entire processing period, and after processing ceases for at least 1 year.

### What happens if the risk cannot be reduced?

Where a high risk is identified, all necessary measures must be taken to reduce it substantially and, where necessary, the State Audit Office must be consulted. If substantial reduction is impossible through additional measures, the data must not be processed.

### What fine applies to failure to carry out the assessment?

Under Article 80 of the law, failure to perform the duty entails a warning or a fine of 2 000 lari where annual turnover does not exceed 500 000 lari, and a warning or a fine of 3 000 lari above that threshold. With aggravating circumstances the fine rises to 3 000 and 5 000 lari respectively.