---
title: "Data Retention Policies"
url: "https://legal.ge/en/service/technology-and-digital-law-en/data-retention-policies-en"
field: "Technology & Digital Law"
description: "Data retention policies: lawful determination of storage periods, the 10-working-day deadlines and records. Legal.ge."
reviewed: "2026-07-09"
updated: "2026-10-22"
publisher: "legal.ge"
---

# Data Retention Policies

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/data-retention-policies-en

## What a data retention policy is and why it is needed

A data retention policy is an internal document that defines, for each category of data, for how long the data are stored, by which criterion the period is determined and what happens after its expiry. This is not an administrative formality: the Georgian Law on Personal Data Protection establishes storage limitation among the principles of processing, and the policy is precisely the instrument through which the organisation demonstrates compliance with that principle.

Unlike other pages, here we deal precisely with the policy document — and not with statutorily mandated retention cases, physical destruction or consultation on storage. The policy unites all of these elements in a single governance framework.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/data-retention-policies-en

### What is a data retention policy?

An internal document defining, for each category of data, the storage period or the criterion for determining it, and the action after expiry. It rests on the storage limitation principle.

### Must the subject be informed of the storage period?

Yes. Upon a subject's request this information is provided no later than 10 working days; in special cases the period may, with substantiation, be extended by a further 10 working days at most.

### How is the policy connected to deletion requests?

An answer to a subject's request must be given within 10 working days. If the period is correctly defined in the policy, the organisation knows exactly whether the purpose has expired — and accordingly whether to delete or to refuse with substantiation.

### Where is the policy reflected in documentation?

In the records related to processing, which include storage periods or the criteria for determining them. Upon request, the records are provided to the State Audit Office within 3 working days.