The legal framework of international data transfers
International data transfer unites two different but closely connected questions: first, when the transfer of data to another state or international organisation is permitted; second, how the Georgian Law on Personal Data Protection extends to controllers registered abroad. This page is oriented precisely towards the second, international dimension: for foreign companies that process data in Georgia and for Georgian organisations cooperating with them.
Under the first paragraph of Article 2 of the law, its scope covers the processing of data on the territory of Georgia by automatic and semi-automatic means, the non-automatic processing of data that form part of a filing system, and also the processing by means of technical facilities located in Georgia by a controller registered outside Georgia. The only exception is where the technical facilities are used solely for the transit of data. This means that foreign services using servers or other technical facilities located in Georgia fall under the Georgian law.