Marketing and the Consent Rule
The processing of personal data for marketing purposes is one of the most strictly regulated spheres under the Law on Personal Data Protection. Under Article 12, regardless of the basis of collection and the availability of the data, processing for the purposes of direct marketing is possible only with the data subject's consent. Moreover, beyond the subject's name, surname, address, telephone number and e-mail address, the processing of any other data for direct marketing requires written consent — behavioural data, interests and a profile thus stand on a higher level of protection than contact fields.
Before obtaining consent, and in the course of marketing, the controller must explain to the subject clearly, simply and understandably the right to withdraw consent at any time and the mechanism of its exercise. The route of withdrawal must be available in the same form in which the marketing is carried out, or by another adequate means — simple and with a clear indication; charging a fee or imposing any other restriction on the exercise of this right is impermissible. The means of requesting cessation must be so simple that the consumer perceives its use as the same act as reading the message — complex forms and multi-step procedures operate contrary to the needs of the law and provoke the reaction of the supervisory authority.
Withdrawal and the Cessation of Processing
Under Article 20, the subject has the right to withdraw their consent at any time, without any explanation or justification. Processing must then cease and/or the data must be deleted or destroyed no later than 10 working days of the request, unless another basis for processing exists. Withdrawal is possible in the same form in which the consent was given, and before withdrawing the subject has the right to request information about the possible consequences of withdrawal. This bundle of rights builds marketing practice into an exact scenario: the subject asks a question, receives an answer and keeps control over their own data — and the cost of that control is transferred entirely to the business.
A specific rule applies to direct marketing: under Article 12, marketing processing must cease within a reasonable period of the subject's request, but no later than 7 working days. The controller also bears the obligation to record and store the time and fact of the giving and withdrawal of consent for the duration of the marketing and for 1 year after its cessation — in other words, a documented trace of every consent must be maintained.
The Burden of Proof and Violations of the Rules
An important detail: in carrying out direct marketing, the burden of proving the existence of consent, the simplicity and accessibility of the opt-out means lies with the controller. In a dispute it is thus the business that must prove that consent existed and that the withdrawal route was simple — not the consumer the opposite. This rule builds lawfulness into marketing practice from the start: the process must be constructed so that every step — the form of consent, its recording, the withdrawal channel — is reflected on paper or in a system; oral promises are worth nothing here.
A breach of the rules ends in a fine. Under Article 71, a violation of the rules of processing for direct marketing entails a warning or a fine: for a natural person, a public institution, a non-commercial legal person, and subjects whose annual turnover does not exceed 500 000 GEL — 2 000 GEL; for legal persons with a turnover exceeding 500 000 GEL — 3 000 GEL. Under aggravating circumstances these amounts rise to 4 000 and 6 000 GEL.
Frequently Asked Questions
Which data require written consent?
All data other than name, surname, address, telephone and e-mail — including behavioural data — require written consent for direct marketing (Article 12).
Within what time must processing cease after withdrawal?
Marketing processing — no later than 7 working days of the request; under the general rule processing ceases and data are deleted within 10 working days, unless another basis exists.
Who bears the burden of proof?
The controller — it must prove the existence of consent and the simplicity of the withdrawal means.
What fine follows a violation?
Under Article 71 — a warning or a fine of 2 000 to 3 000 GEL depending on turnover; under aggravating circumstances — up to 4 000 or 6 000 GEL.
How We Help on Legal.ge
Lawful marketing-data processing is the harmony of four components: the correct form of consent, a simple withdrawal mechanism, observance of the deadlines, and the discipline of record-keeping. Each of them requires separate verification, and the only reliable basis among them is documented practice.
The lawyers working on Legal.ge will help you audit consent forms and marketing processes, design withdrawal mechanisms, implement a record-keeping system and deal with the supervisory authority. Contact us for a consultation — a clean marketing database is worth far more than a fine.