What a legal hold obligation is and why deletion is not an absolute right
A legal hold obligation means the systematic management of those situations in which an organisation must retain data even though the original purpose of processing has already been achieved. In Georgia this subject is governed by the Law on Personal Data Protection, and it is precisely the norms of this law that create the framework within which a data subject's deletion request may lawfully be refused. The task of this page is to single out exactly these — statutorily imposed and statutorily permitted retention — cases and to explain how an organisation should manage them.
The foundation lies in Article 4 of the law. Among the processing principles, a rule of storage limitation is defined: data may be stored only for the period necessary to achieve the corresponding legitimate purpose, and once the purpose has been achieved they must be deleted, destroyed or stored in depersonalised form. Yet precisely here an important exception is embedded: this requirement does not apply where the processing of data is determined by a law or by a subordinate normative act issued in accordance with the law, and the storage of the data is a necessary and proportionate measure in a democratic society for the protection of superior interests. From this exception the entire practice of legal hold arises.
Statutory grounds for retention
Article 5 of the law regulates the grounds for processing data, which are decisive for legal holds. Two of them concern our subject directly. First: the processing of data is admissible if it is provided for by law. Second: processing is admissible if it is necessary for the performance of duties imposed on the controller by the legislation of Georgia. Where a specific law or a normative act issued on its basis establishes a retention period — in the tax, accounting, banking or another field — that period replaces the general rule established by Article 4, and deleting the data before that period expires is unlawful.
In addition, the list of grounds includes cases such as processing with the data subject's consent, for the performance of an obligation under a contract with the subject, the public availability of the data, the protection of vital interests, significant public interest and legitimate interests. Each of these grounds must be analysed separately: if at the moment of a deletion request any of them continues to operate, its existence may become a ground for refusing deletion. One further rule is important: the duty to substantiate the legal ground of processing rests on the controller, which means that it is precisely the organisation that must be able to establish and prove why the data are being retained.
The data subject's deletion request and response deadlines
Article 16 of the law gives the data subject the right to demand from the controller the cessation, deletion or destruction of the processing of data concerning him or her, including profiling. The response deadline is clearly defined: no later than 10 working days from the request, unless otherwise provided by the legislation of Georgia, the processing must cease and the data be deleted or destroyed, or the subject must be notified of the ground for refusal with an explanation of the appeal procedure.
The subject also has the right to receive information about the cessation, deletion or destruction of processing immediately upon the performance of the relevant action, but no later than 10 working days. This means that an organisation's internal procedures must be tied to these two deadlines rather than to intuitive waiting periods.
When deletion may be refused
The third paragraph of Article 16 names four situations in which the controller has the right to refuse to satisfy a deletion request. First: any of the grounds provided for by Article 5 or Article 6 exists — including the situation where processing is provided for by law or is necessary for the performance of a statutory duty. Second: the data are processed for the purpose of substantiating a legal claim or defence. Third: the processing is necessary for the exercise of the right to freedom of expression or information. Fourth: the data are processed for archiving purposes in the public interest, for scientific or historical research or statistical purposes, where deletion would render the achievement of those purposes impossible or significantly impair them.
Where any of these grounds exists, the controller bears the duty to substantiate the corresponding ground. This is a very important detail: a refusal is lawful only if it is substantiated, and not when an organisation simply does not wish to release the data. The essence of managing legal holds lies precisely here: each retention case must have a documented, law-based ground and a defined period.
In addition, where the data were processed in a publicly available form, the subject has an additional right — to demand the restriction of availability and the deletion of copies of the data or of any internet link connected with the data. This right is particularly relevant for information published on websites.
Notifying recipients and their obligations
The deletion process rarely stays within the boundaries of a single organisation. Under the law, the controller is obliged to notify all recipients of the data, as well as every other controller and processor to whom it transferred the data, of the cessation, deletion or destruction of processing. An exception is allowed only where providing such information is impossible because of the number of persons involved or disproportionately high costs.
The subsequent action is equally important: upon receiving the information, those persons are obliged to cease the processing and to delete or destroy the data. Thus, proper management of legal holds requires maintaining a register of recipients and processors so that the notification duty can actually be performed at the necessary moment.
Restriction of rights and the distribution of the burden of proof
Article 21 of the law establishes that the corresponding rights of the data subject, including the right to deletion, may be restricted where this is directly provided for by the legislation of Georgia, where this does not violate human fundamental rights and freedoms, and where it is a necessary and proportionate measure in a democratic society. Among the grounds for restriction the law lists, for example, the interests of state security, information security and cybersecurity, public safety, the prevention and investigation of crime, the administration of justice, financial or economic interests significant for the country, the protection of state, commercial and professional secrets, and the substantiation of a legal claim or defence.
A restrictive measure may be applied only to the extent necessary to achieve the purpose of the restriction, and the decision on the restriction and on the refusal must be notified to the subject, except where providing the information would endanger the achievement of the purpose. A decisive procedural rule should also be noted here: where a right is restricted or a request refused, the burden of proof rests on the controller. In other words, in a disputed case it is the organisation that must prove the lawfulness of the retention, not the subject the unlawfulness of it.
The Legal.ge team will help you systematise legal hold obligations: we will compile a documented map of the retention periods operating in your field, prepare templates for substantiating refusals and work out a recipient notification procedure, so that every retained piece of data has a lawful ground and a defined period.