About this service
Digital data storage is the daily routine of almost every organisation, yet legally it is one of the least considered processes: data is kept because „it was set up that way“, not because a purpose requires it. In Georgia the legal framework for data storage is defined by the Georgian law on personal data protection — its norms on principles, security, data protection by design and default, and records together create the rules under which digital data must be stored. This service is legal consultation built precisely on that framework: we analyse how and for how long your data is stored, how far this complies with the law, and what a properly constructed storage regime looks like.
The storage-limitation principle — data is kept until the purpose is achieved
Article 4 of the law establishes the principles of data processing, and for storage the decisive one is this: data may be stored only for the period necessary to achieve the corresponding legitimate purpose of processing. Once the purpose for which the data is processed has been achieved, the data must be deleted, destroyed or stored in depersonalised form — except where processing is determined by law or by a subordinate normative act issued in conformity with law, and storage is a necessary and proportionate measure. The same principles add that data must be accurate: inaccurate data must be corrected, erased or destroyed without unjustified delay. In practical terms this means concrete work: an organisation must know, for every category of data, what the storage purpose is, when the purpose is achieved, and what happens after that moment.
Security measures — what must be safeguarded during storage
Article 27 of the law regulates the security obligation: the controller must take appropriate technical and organisational measures to ensure that data is processed in conformity with the law and must be able to demonstrate that conformity. The measures significant for digital storage are named concretely: the controller and the processor must take organisational and technical measures corresponding to the possible and accompanying risks — including pseudonymisation of data, logging of access to data, and information-security mechanisms ensuring confidentiality, integrity and availability. The measures must be proportionate: account must be taken of the categories and volume of data, the purpose, form and means of processing, and the possible risks to the rights of data subjects, and the effectiveness of the measures must be assessed periodically. In a storage consultation we examine exactly these elements: is access logged, is backup appropriate, who can see what, and how the system protects data from loss and disclosure.