---
title: "Employee Data Privacy"
url: "https://legal.ge/en/service/technology-and-digital-law-en/employee-data-privacy-en"
field: "Technology & Digital Law"
description: "Employee data in Georgia: bases, special category, video monitoring rules and automated decisions. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Employee Data Privacy

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/employee-data-privacy-en

## Employee data: from bases to monitoring

The workplace is one of the most data-intensive environments: an employer collects identity, pay, leave, evaluation and often behavioural data about candidates and employees. The Law of Georgia on Personal Data Protection governs this field through its general rules, yet several norms — the list of bases, the employment ground for special-category data, video monitoring and automated decisions — are of particular significance precisely for employees. On this page we explain these rules together.

## Processing bases and their justification

Processing is admissible where one of the statutory bases exists: the subject's consent for a specific purpose; performance of an obligation under a contract with the subject or the taking of steps at the subject's request before entering a contract; processing provided for by law; performance of duties imposed by legislation; public availability of the data; protection of vital interests; significant public interest; tasks in the public interest; the legitimate interests of the controller or a third party — except where the subject's overriding interest prevails; and consideration of the subject's application. In the employment context the most frequently operating grounds are the contractual obligation, the statutory duty and legitimate interests. One thing is decisive: the obligation to justify the basis rests on the employer itself — every data flow must have a known basis it stands on.

## Special-category data and the employment ground

Special-category data — health, racial or ethnic origin, political views, religious or philosophical beliefs, trade-union membership and others — may be processed only on statutory grounds and with safeguards secured. This list contains a ground specific to the employment context: the processing of special-category data is necessary in the context of employment obligations and relations, including for taking decisions on employment or assessing the work skills of the employee. In other cases written consent, direct regulation by law or another listed ground is required. Health data in an employment context is therefore processable, but only under this specific ground or another lawful basis — not by general necessity.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/employee-data-privacy-en

### Which basis may an employer use to process data?

Most often — performance of a contractual obligation, a duty imposed by legislation, or legitimate interests. Justifying the basis rests on the employer itself.

### Can health data be processed at work?

Only under the special regime. The law sets a distinct ground: processing necessary in the context of employment obligations and relations, including employment decisions or the assessment of work skills. Otherwise written consent or another lawful ground is required.

### When is video monitoring of employees admissible?

Only exceptionally — where achieving a statutorily permitted purpose by other means is impossible or requires disproportionate effort. A written policy, a warning sign and written warning of the employee about the specific purpose are required.

### How to respond to algorithmic evaluation?

On the subject's request a human resource must be involved in the process, with the possibility to express a view and appeal. A solely automated significant decision is allowed only with explicit consent, by contract or by law.