Can the officer's function be outsourced?

Yes. Under the third paragraph of Article 33, the function may be performed by an employee or by another person on the basis of a services contract. Several organisations may also have a common officer.

Within what period is the State Audit Office notified?

Within 10 working days of the officer's appointment, designation or replacement, the identity and contact information are notified to the State Audit Office and published on the website.

What sanction is provided?

Under Article 82: a warning for a first violation; a repeat within 1 year of the imposition of an administrative penalty by the General Auditor — a fine of 3 000 lari.

DPO Outsourcing in Georgia

Q: Who is obliged to appoint an officer?

Public agencies, insurance organisations, commercial banks, microfinance organisations, credit bureaux, electronic communications companies, airlines, airports, medical facilities, as well as processors of large volumes of data and those conducting systematic large-scale monitoring.

The institution of the data protection officer under Georgian legislation

The data protection officer is the figure who personally ensures the lawfulness of data protection in an organisation. This institution is defined by Article 33 of the Georgian Law on Personal Data Protection, and it is precisely on that article that the outsourcing model rests as well — transferring the officer's function to an external person under a services contract. This page examines who is obliged to appoint an officer, what functions the officer has and how the outsourcing model works in accordance with the law.

An initial clarification is important: this is not a certification regime, and the law does not require formalities connected with special qualifications. The requirement is different: the officer must have appropriate knowledge in the field of data protection, must be accountable, taking into account the specific circumstances, before the highest possible level of governance, and his or her independence must be ensured.

Who is obliged to appoint an officer

Under the first paragraph of Article 33, the appointment or designation of a data protection officer is obligatory for: a public agency, an insurance organisation, a commercial bank, a microfinance organisation, a credit bureau, an electronic communications company, an airline, an airport, a medical facility, and also a controller or processor that processes data of a large number of data subjects or carries out systematic and large-scale monitoring of their behaviour.

Beyond the enumerated cases, other controllers have the right, at their own discretion, to appoint or designate an officer. The circle of persons who do not have this obligation is determined by a normative act of the General Auditor.

The officer's functions

The law regulates the officer's functions precisely. The officer ensures the informing and consultation of the controller, the processor and their employees on issues connected with data protection, including the adoption or amendment of regulatory legal norms; participates in the development of internal regulations and of the data protection impact assessment document; monitors the performance of Georgian legislation and internal organisational documents; analyses incoming applications and complaints and issues recommendations; receives consultations from the State Audit Office and represents the controller and the processor in relations with it; submits information and documents at its request; coordinates and monitors the performance of its assignments and recommendations; and, where a data subject applies, provides the subject with information on the processing processes and his or her rights.

These functions reflect that the officer is not merely a nominal position: it is a centre of knowledge, control and communication standing between the organisation and the supervisory authority.