The legal framework of information governance in Georgia
Information governance means a system of managing data within an organization that ensures lawful collection, accuracy, security, and the ability to demonstrate all of it. Georgia has no separate sectoral statute for this field — the legal framework of information governance is built on the Georgian Law on Personal Data Protection, which shares the approaches of the European Union's General Data Protection Regulation, but it is precisely this law that creates the binding rules for Georgian organizations. In practice the framework consists of four pillars: the principles of processing together with accountability, protection by design, processing records together with the data protection officer institution, and security measures. Each is examined in detail below.
Principles of data processing and accountability
Point 1 of Article 4 of the law names the principles that must be respected in any processing: data must be processed lawfully, fairly, transparently for the subject and without violating their dignity; data is collected only for specific, clearly defined and legitimate purposes, and further processing for a purpose incompatible with the original one is impermissible; data is processed only to the extent necessary for achieving the legitimate purpose; data must be genuine and accurate, and inaccurate data must be corrected, deleted or destroyed without unjustified delay; data is stored only for the period necessary to achieve the purpose, after which it is deleted, destroyed or stored in depersonalized form; and finally, appropriate technical and organizational measures must be taken for security purposes.
Especially important is point 7 of the same article: the controller is responsible for compliance with these principles during processing and must be able to demonstrate their observance. This is the accountability principle — lawfulness must not only exist, it must be demonstrable. Where data is processed for a purpose different from the initial one, and this is not done with the subject's consent or on a legal basis, the controller must weigh the connection between the original and the new purpose, the character of its relationship with the subject, the subject's reasonable expectations, whether special categories of data are processed, the possible consequences, and the existing security measures.
Protection by design and by default
Article 26 of the law requires that, when creating a new product or service, the controller adopt appropriate technical and organizational measures — pseudonymization included — both when determining the means of processing and within the processing itself. These measures must secure the effective implementation of the processing principles and the integration of protective mechanisms to safeguard the subject's rights. Point 2 of the same article fixes the default rule: when determining the quantity, scale, storage periods and access to data, it must be ensured that only the volume of data necessary for the specific purpose is processed automatically, and that before an alternative approach is chosen, an indefinite circle of persons is automatically granted access only to minimal data. In terms of information governance, this means system design must begin precisely from data minimization.