What is a data retention policy?

An internal document defining, for each category of data, the storage period or the criterion for determining it, and the action after expiry. It rests on the storage limitation principle.

Must the subject be informed of the storage period?

Yes. Upon a subject's request this information is provided no later than 10 working days; in special cases the period may, with substantiation, be extended by a further 10 working days at most.

How is the policy connected to deletion requests?

An answer to a subject's request must be given within 10 working days. If the period is correctly defined in the policy, the organisation knows exactly whether the purpose has expired — and accordingly whether to delete or to refuse with substantiation.

Where is the policy reflected in documentation?

In the records related to processing, which include storage periods or the criteria for determining them. Upon request, the records are provided to the State Audit Office within 3 working days.

Data Retention Policies in Tbilisi, Georgia

What a data retention policy is and why it is needed

A data retention policy is an internal document that defines, for each category of data, for how long the data are stored, by which criterion the period is determined and what happens after its expiry. This is not an administrative formality: the Georgian Law on Personal Data Protection establishes storage limitation among the principles of processing, and the policy is precisely the instrument through which the organisation demonstrates compliance with that principle.

Unlike other pages, here we deal precisely with the policy document — and not with statutorily mandated retention cases, physical destruction or consultation on storage. The policy unites all of these elements in a single governance framework.

The legal foundation: the storage limitation principle

The relevant subparagraph of the first paragraph of Article 4 of the law establishes: data may be stored only for the period necessary to achieve the corresponding legitimate purpose. Once the purpose has been achieved, they must be deleted, destroyed or stored in depersonalised form. There is only one exception: where the processing is determined by a law or a subordinate normative act issued in accordance with the law and storage is a necessary and proportionate measure for the protection of superior interests in a democratic society.

This principle determines every subsequent element of the policy: the period is derived from the purpose, not from habit, opinion or technical comfort. The phrase "perhaps we should not delete yet" must not exist in a policy unless it has a lawful ground.

Periods comprehensible to the subject: the information requirement

The policy must also be visible from outside. Under the relevant subparagraph of the first paragraph of Article 13 of the law, the data subject has the right to demand from the controller, free of charge, information on the storage period of the data, and where determining a specific period is impossible — on the criteria for determining the period. This means that "indefinite storage" is not lawful in a policy: either a specific period must be indicated or a clear criterion by which it is calculated.

The second paragraph of Article 13 also sets the deadline for providing this information: the subject receives an answer no later than 10 working days from the request, and in special cases, with proper substantiation, this period may be extended by no more than a further 10 working days, of which the subject is notified immediately. The policy must provide for the procedure for these two deadlines in advance.

Data Retention Policies