---
title: "IoT Data Privacy"
url: "https://legal.ge/en/service/technology-and-digital-law-en/iot-data-privacy-en"
field: "Technology & Digital Law"
description: "IoT data privacy in Georgia: principles, protection by design, security measures and the 72-hour incident duty. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-10-14"
publisher: "legal.ge"
---

# IoT Data Privacy

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/iot-data-privacy-en

## Connected device data and the Georgian law

Internet-connected devices — sensors, household appliances, wearable gadgets, industrial controllers — continuously collect information about owners and users: location, regime, habits, sometimes health indicators. Georgia has no separate sectoral statute for the confidentiality of connected devices, and this should be said plainly: data flows from connected devices run on the general regime — the Law of Georgia on Personal Data Protection. That law demands protection at the level of design, security measures, processing principles and incident response. Below we explain how these requirements extend to a connected-device product.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/iot-data-privacy-en

### Is there a separate privacy statute for connected devices?

No. There is no sectoral statute; connected-device data runs on the general regime of the Law on Personal Data Protection — principles, protection by design, security and incident notification.

### What does minimisation at design level mean?

It means that when creating a new product, the automatically applied initial method must be the processing of and access to only the minimal volume of data, including through pseudonymisation. Data beyond what a specific purpose requires must not be processed automatically.

### Which security measures are required?

Organisational and technical measures corresponding to possible and accompanying threats, including pseudonymisation, access logging and mechanisms ensuring confidentiality, integrity and accessibility. Their effectiveness is periodically assessed and updated as needed.

### Within what term must an incident be notified?

No later than 72 hours from discovery the State Audit Service must be notified in writing or electronically, unless significant harm is unlikely. The notice covers the circumstances, the affected data, the damage and the measures.