---
title: "Marketing Data Compliance"
url: "https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1577-en"
field: "Technology & Digital Law"
description: "Direct marketing: the consent rule, the 7-working-day deadline and fines up to 6 000 lari. Legal.ge."
reviewed: "2026-03-25"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Marketing Data Compliance

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1577-en

## Direct marketing and the data protection law

Short messages, emails, calls and postal materials are all forms of direct marketing, and in Georgia they are governed by Article 12 of the Law on Personal Data Protection. The relevant subparagraph of Article 3 of the law defines direct marketing as the direct and immediate provision of information to the data subject by telephone, mail, e-mail or other electronic means for the purpose of forming, maintaining, realising or supporting interest in a natural or legal person, goods, an idea, a service or an initiative.

Managing this field looks simple, but it is precisely marketing campaigns where data protection rules are violated most often. Discussed below are the consent rule, the withdrawal mechanism, the burden of proof and the sanctions.

## The consent rule: what may and may not be done

Under the first paragraph of Article 12, regardless of the ground for collecting the data and their availability, the processing of data for direct marketing purposes is possible only with the data subject's consent. This is a decisive detail: the fact that data were lawfully collected for another purpose does not automatically grant the right to use them for marketing.

The second paragraph establishes that, apart from the subject's name, surname, address, telephone number and e-mail address, the processing of other data for direct marketing purposes requires written consent. Thus ordinary consent suffices for contact data, while for other data only written consent applies.

Before receiving consent and during the campaign the law requires that the subject be explained clearly, simply and comprehensibly the right to withdraw consent at any time and the mechanism for exercising it. The subject must also be able to demand the cessation of processing in the same form in which the marketing is carried out, and this means must be simple. Establishing a fee or other restriction for withdrawal is inadmissible.

## Cessation and withdrawal of consent

Under the fourth paragraph of Article 12, the controller or processor is obliged to cease the processing of data for direct marketing purposes within a reasonable period of receiving the subject's corresponding request, but no later than 7 working days. The obligation to exchange information about withdrawal must be embedded in the organisation's internal processes, so that different departments stop bothering the same subject.

The general ground operates as well: under the first paragraph of Article 20, the subject has the right to withdraw consent at any time, without any explanation or substantiation. In that case the processing must cease or the data be deleted or destroyed no later than 10 working days from the request, unless another ground exists. Before withdrawing, the subject may demand and receive information about the possible consequences of withdrawal.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/marketing-data-compliance-1577-en

### What is needed for a marketing message?

The data subject's consent — without exception. For data other than name, surname, address, telephone and e-mail, written consent is required.

### Within what period is processing ceased upon withdrawal?

Processing for direct marketing ceases no later than 7 working days from the request. Under the general withdrawal rule, processing ceases or the data are deleted within 10 working days unless another ground exists.

### Who proves the existence of consent?

The organisation. The burden of proving consent, the simplicity and accessibility of the refusal mechanism rests on it. For this the time and fact of consent are kept for the campaign period and 1 year after cessation.

### What fine is provided?

Under Article 71: a warning or 2 000 lari at turnover up to 500 000 lari and a warning or 3 000 lari above; with aggravating circumstances — 4 000 and 6 000 lari.