Document destruction as a form of data processing
Document destruction is often perceived as a mere technical operation — passing paper through a shredder or deleting a file. Under Georgian law this is not so: the concept of processing defined in Article 3 of the Law on Personal Data Protection directly includes deletion and destruction, just as it includes collection, storage, alteration, use and disclosure. Destruction is therefore full-fledged processing: it must be lawful, planned and documented.
The same article defines the concept of depersonalisation — such processing of data as a result of which linking them to a specific person becomes impossible. Depersonalisation is an alternative to destruction in those cases where the anonymous form of the data is still needed for statistics or analytics, but the link to the person is not.