What a legal hold obligation is and why deletion is not an absolute right
A legal hold obligation means the systematic management of those situations in which an organisation must retain data even though the original purpose of processing has already been achieved. In Georgia this subject is governed by the Law on Personal Data Protection, and it is precisely the norms of this law that create the framework within which a data subject's deletion request may lawfully be refused. The task of this page is to single out exactly these — statutorily imposed and statutorily permitted retention — cases and to explain how an organisation should manage them.
The foundation lies in Article 4 of the law. Among the processing principles, a rule of storage limitation is defined: data may be stored only for the period necessary to achieve the corresponding legitimate purpose, and once the purpose has been achieved they must be deleted, destroyed or stored in depersonalised form. Yet precisely here an important exception is embedded: this requirement does not apply where the processing of data is determined by a law or by a subordinate normative act issued in accordance with the law, and the storage of the data is a necessary and proportionate measure in a democratic society for the protection of superior interests. From this exception the entire practice of legal hold arises.