The Purpose of the Law and What It Protects
Under Article 1 of the Law of Georgia on Personal Data Protection, the purpose of the law is to protect, in the processing of personal data, human fundamental rights and freedoms, including the rights to inviolability of private and family life, personal space and communication. This framing matters: data protection here is not a technical topic but part of the system of human rights, and it is through that prism that the law assesses every act of processing, from a small business's client base to state registries.
The Scope of the Law
Under Article 2, the law applies to the processing of data by automatic and semi-automatic means, and to non-automatic processing of data intended for inclusion in a filing system. It also applies to processing by a controller registered abroad carried out with technical means located in Georgia, except where those means are used only for transit. At the same time, the law does not apply to processing by a natural person purely for personal or family purposes, to processing for state security, defence, intelligence and counter-intelligence purposes, to processing in court proceedings, to processing by the media for informing the public, and to processing for academic, artistic and literary purposes. In addition, any person who accidentally receives data not intended for them must respect the rights of the data subject and must not attempt unlawful processing. This scope creates a balance between private space and public interests.
The Principles of Processing
Article 4 establishes six core principles: data must be processed lawfully, fairly, transparently and without violating dignity; collected only for specific, clearly defined and legitimate purposes; processed only to the extent necessary; kept accurate and, where necessary, up to date; stored only for the period necessary for the purpose; and protected by appropriate technical and organizational measures. Special attention is paid to further processing: where data are processed for a purpose other than the original one without consent or a statutory basis, the controller must consider the connection between the original and the new purpose, the nature of the relationship, the subject's reasonable expectations and the possible consequences. The use of data collected by law enforcement bodies for general analysis of criminal activity is a recognized exception, and long-term storage for archiving, scientific or statistical purposes is permitted with appropriate security measures. The controller is responsible for compliance with the principles and must be able to demonstrate it.
The Grounds for Processing
Under Article 5, processing is permitted where one of the grounds exists: the subject's consent for specific purposes; performance of an obligation under a contract or steps prior to concluding one at the subject's request; processing envisaged by law; publicly available data; protection of vital interests; protection of a significant public interest; performance of tasks in the sphere of public interest; the legitimate interests of the controller or a third party, unless the subject's interests prevail; or examination of the subject's application. The obligation to substantiate the legal ground rests on the controller, which in practice means that every company on the market must be able to indicate on what ground it processes data.
The special rule of the law does not extend to the processing of special categories of data for the purposes of a population census, which serves the needs of official statistics, while institutions acting for security, intelligence or judicial purposes remain covered by the law where they process data by automatic or semi-automatic means or prepare them for a filing system. Despite its transitional character, this norm also matters for international platforms operating on the Georgian market. In applying the principles, the controller must distinguish fact-based data from data based on personal assessment, since strict compliance with the accuracy principle is not mandatory for data resting on personal assessment. The list of grounds is exhaustive: processing based on any other ground is unlawful, so a process must first define its ground and only then collect the data.
Frequently Asked Questions about the Law
Does the law apply to private correspondence?
No. It does not apply to processing by a natural person purely for personal or family purposes, which includes correspondence.
What happens after the purpose is achieved?
The data must be erased, destroyed or stored in depersonalized form, unless storage is otherwise provided by law.
May data be used for another purpose?
Further processing for a purpose incompatible with the original one is inadmissible; certain purposes, such as archiving, research or statistics, are deemed compatible.
Who must prove the lawfulness of processing?
Substantiating the ground and demonstrating compliance with the principles is the controller's obligation.
How We Help on Legal.ge
If your company processes the data of clients or employees and you want a compliance assessment, the Legal.ge team will help you identify the grounds of processing, analyse the principles and prepare internal procedures, mapping data flows and documenting the legal basis for each of them.