---
title: "Marketing Data Compliance"
url: "https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1572-en"
field: "Technology & Digital Law"
description: "Marketing data compliance: direct marketing by consent, withdrawal within 7-10 working days, fines up to 6 000 GEL. Legal.ge."
reviewed: "2026-07-05"
updated: "2026-10-20"
publisher: "legal.ge"
---

# Marketing Data Compliance

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1572-en

## Marketing and the Consent Rule

The processing of personal data for marketing purposes is one of the most strictly regulated spheres under the Law on Personal Data Protection. Under Article 12, regardless of the basis of collection and the availability of the data, processing for the purposes of direct marketing is possible only with the data subject's consent. Moreover, beyond the subject's name, surname, address, telephone number and e-mail address, the processing of any other data for direct marketing requires written consent — behavioural data, interests and a profile thus stand on a higher level of protection than contact fields.

Before obtaining consent, and in the course of marketing, the controller must explain to the subject clearly, simply and understandably the right to withdraw consent at any time and the mechanism of its exercise. The route of withdrawal must be available in the same form in which the marketing is carried out, or by another adequate means — simple and with a clear indication; charging a fee or imposing any other restriction on the exercise of this right is impermissible. The means of requesting cessation must be so simple that the consumer perceives its use as the same act as reading the message — complex forms and multi-step procedures operate contrary to the needs of the law and provoke the reaction of the supervisory authority.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1572-en

### Which data need written consent?

Everything beyond contact fields — written consent is required for direct marketing of all other data (Article 12).

### How quickly does processing stop after withdrawal?

Marketing processing — within 7 working days; under the general rule, within 10 working days processing ceases and data are deleted (Articles 12, 20).

### Who bears the burden of proof?

The controller — proving consent and the simplicity of the withdrawal means is its burden.

### What fine exists?

A warning or 2 000 to 3 000 GEL; in aggravated cases — up to 4 000 or 6 000 GEL by turnover (Article 71).