---
title: "Legal Hold Management"
url: "https://legal.ge/en/service/technology-and-digital-law-en/legal-hold-management-en"
field: "Technology & Digital Law"
description: "Legal holds and the right to deletion under the Georgian data protection law: statutory grounds, the 10-working-day deadline and refusal rules. Legal.ge."
reviewed: "2026-07-09"
updated: "2026-11-03"
publisher: "legal.ge"
---

# Legal Hold Management

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/legal-hold-management-en

## What a legal hold obligation is and why deletion is not an absolute right

A legal hold obligation means the systematic management of those situations in which an organisation must retain data even though the original purpose of processing has already been achieved. In Georgia this subject is governed by the Law on Personal Data Protection, and it is precisely the norms of this law that create the framework within which a data subject's deletion request may lawfully be refused. The task of this page is to single out exactly these — statutorily imposed and statutorily permitted retention — cases and to explain how an organisation should manage them.

The foundation lies in Article 4 of the law. Among the processing principles, a rule of storage limitation is defined: data may be stored only for the period necessary to achieve the corresponding legitimate purpose, and once the purpose has been achieved they must be deleted, destroyed or stored in depersonalised form. Yet precisely here an important exception is embedded: this requirement does not apply where the processing of data is determined by a law or by a subordinate normative act issued in accordance with the law, and the storage of the data is a necessary and proportionate measure in a democratic society for the protection of superior interests. From this exception the entire practice of legal hold arises.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/legal-hold-management-en

### May data be stored after the purpose has been completed?

As a general rule — no: after the purpose is achieved the data must be deleted, destroyed or depersonalised. However, Article 4 of the law provides an exception: where processing is determined by law or by a subordinate normative act and the storage is necessary and proportionate, the data lawfully remain.

### Within what period must an organisation respond to a deletion request?

Under Article 16, no later than 10 working days from the request the processing must cease and the data be deleted or destroyed, or the subject must be notified of the ground for refusal with an explanation of the appeal procedure. Information about the action taken is also provided within 10 working days.

### When does an organisation have the right to refuse?

There are four cases: another lawful ground exists; the data are needed to substantiate a legal claim or defence; the processing is necessary for freedom of expression or information; or the data serve archiving, scientific, historical or statistical purposes. A refusal must always be substantiated.

### Who proves the lawfulness of retention in a dispute?

The burden of proof rests on the controller. A restriction of rights may be applied only to the necessary extent and must be proportionate in a democratic society.