The legal framework of international data transfers
International data transfer unites two different but closely connected questions: first, when the transfer of data to another state or international organisation is permitted; second, how the Georgian Law on Personal Data Protection extends to controllers registered abroad. This page is oriented precisely towards the second, international dimension: for foreign companies that process data in Georgia and for Georgian organisations cooperating with them.
Under the first paragraph of Article 2 of the law, its scope covers the processing of data on the territory of Georgia by automatic and semi-automatic means, the non-automatic processing of data that form part of a filing system, and also the processing by means of technical facilities located in Georgia by a controller registered outside Georgia. The only exception is where the technical facilities are used solely for the transit of data. This means that foreign services using servers or other technical facilities located in Georgia fall under the Georgian law.
The special representative: who needs one and when
Under the first paragraph of Article 34, where a controller or processor registered outside Georgia processes data by means of technical facilities located in Georgia, it is obliged, before processing, to appoint or designate a special representative in Georgia. The representative is registered under the procedure established by a normative act issued by the State Audit Office.
The sequence here is clearly defined: the controller acquires the right to process data only after the registration of the special representative. In other words, first registration — then processing. The representative is obliged to fulfil the requirements imposed by the General Auditor in the manner established by law, and its appointment does not release the foreign person from this obligation.
The data subject has the right to demand the exercise of his or her rights against a foreign controller through the special representative. At the same time, the appointment obligation does not extend to persons based in European Union member states to whom the personal data protection rules operating in the European Union apply, or to persons based in states recognised by the European Union as states with adequate data protection.
The rules of permissive transfer
The lawfulness of an international transfer itself is established by Article 37. Transfer is admissible where the requirements provided for by law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state. In addition, the law names permitted exceptional grounds, including international treaties, contractual guarantees with the permission of the State Audit Office, informed written consent, vital interests and significant public interest.
In every case the controller is obliged to adopt the organisational and technical measures necessary for the secure transfer of data, and the onward transfer of transferred data to a third party is admissible only where it serves the original purposes and satisfies the same grounds and guarantees.
Recording transfers
Under the first paragraph of Article 28, the controller and its special representative are obliged to ensure, in writing or electronically, the recording of information related to processing, which includes the identity of the parties, the purposes, the categories of subjects and data, the recipients of data, information on transfers to another state and on appropriate guarantees — including the permission of the State Audit Office — storage periods, security measures and incidents.
The recorded information must be provided immediately upon the corresponding request of the State Audit Office, but no later than 3 working days. For international transfers this record is particularly significant: it is the instrument through which the organisation confirms to the supervisory authority that transfers took place on lawful grounds.
What a foreign person should know when operating in Georgia
From a practical point of view, entering the Georgian market in terms of data processing requires a staged plan. First: determining the scope of the law — whether the organisation processes data using technical facilities located in Georgia or uses only transit. Second: if the facilities are genuinely used, assessing whether the organisation is excluded from the special representative obligation due to European Union membership or adequate-protection status. Third: if the obligation exists, the selection and registration of a representative begins, since processing is permitted only after that. Fourth: arranging the records, because a request of the supervisory authority must be closed within 3 working days.
For Georgian organisations cooperating with foreign partners, checking the partner's status is important: whether it has a special representative registered in Georgia and on which ground the transfer takes place. Reliable cooperation begins precisely with this verification. The Legal.ge team will help both foreign persons in the process of appointing and registering a special representative and Georgian organisations with the recording and substantiation of international transfers.
Frequently asked questions
Who does not need a special representative?
A person established in a European Union member state to which the personal data protection rules operating in the European Union extend, and a person established in a state recognised by the European Union as having adequate data protection.
When does the right to process arise?
Only after the registration of the special representative — before processing data with technical means located in Georgia, the representative must be appointed or designated.
Does the representative release the foreign person from all duties?
No — the duty to respond to the Auditor General’s request or decision remains with the responsible person; the data subject may also demand the exercise of their right through the representative.
How We Help on Legal.ge
The lawyers of Legal.ge determine whether your structure needs a special representative, prepare the appointment and registration, assemble the grounds of permissive transfer and ensure communication with the supervisory authority through the representative.