European Standard and Georgian Law: What Compliance Actually Targets
The European Union's General Data Protection Regulation does not apply directly in Georgia — the operative law for the Georgian market is the Georgian Law on Personal Data Protection. At the same time, many Georgian companies serve European consumers and transfer data to European partners, so a compliance programme must answer to both regimes. The practical route is this: internal documents and processes are built on the specific requirements of the Georgian law, while the equivalent European level of protection is secured where both regimes demand the same thing — lawful grounds, transparency, data-subject rights and security measures.
Notably, the Georgian law's core blocks mirror the European regulation's architecture: processing principles, lawful bases, the rights of data subjects to information, rectification and erasure, and the right to complain. The differences lie in the details — deadlines, the supervisory authority and the sanctions regime. That is why a compliance audit runs in two layers: first a check of the obligations defined by the Georgian law, then a clarification of the grounds for transferring data to European partners.
Processing Principles: Lawfulness, Proportionality, Storage Limits
Article 4 of the Georgian law lays down the processing principles. Data must be processed lawfully, fairly, transparently for the data subject and without violating their dignity. Data must be collected only for specific, clearly defined and legitimate purposes, and further processing for a purpose incompatible with the original purpose is impermissible. Data must be processed only to the extent necessary to achieve the relevant legitimate purpose and must be proportionate to that purpose. Data must be accurate and, where necessary, kept up to date — inaccurate data must be corrected, deleted or destroyed without unjustifiable delay.
The same article provides that data may be stored only for the period necessary to achieve the relevant purpose; once the purpose is achieved, the data must be deleted, destroyed or stored in depersonalised form, except in cases defined by law. For security, technical and organisational measures must be taken that adequately ensure the protection of data, including from unauthorised or unlawful processing, accidental loss, destruction or damage. The controller is responsible for compliance with these principles and must be able to demonstrate compliance — this is precisely the requirement that makes a documented compliance programme indispensable.
Lawful Bases: What Your Processes Stand On
Article 5 defines the permissible grounds for processing: the data subject's consent for one or several specific purposes; performance of an obligation under a contract with the data subject or conclusion of a contract at the subject's request; processing provided for by law; performance of duties imposed on the controller by Georgian legislation; data made publicly available by law or by the subject; protection of the vital interests of the subject or another person, including monitoring the spread of epidemics, managing humanitarian crises and disasters; protection of a significant public interest; performance of tasks in the sphere of public interest defined by Georgian legislation; protection of the legitimate interests of the controller or a third party, unless the overriding interest of the data subject's rights prevails; and consideration of the data subject's application. Each process needs a chosen and recorded ground, because the burden of demonstrating the legal basis lies on the controller.