The Content of the Policy — What Must Be Written
A privacy policy is not legal literature but the fulfilment of a statutory list of information. Under Article 24, where data are collected directly from the data subject, the controller is obliged, before collection or at its start, to provide at least the following: the identity and contact information of the controller, its representative or the processor; the purposes and the legal basis of the processing; whether the provision of data is mandatory and the consequences of refusal; the significant legitimate interests; the identity of the data protection officer, where one exists; the recipient or categories of recipients; the planned transfer to another state; the storage period or the criteria for determining it; and the subject's rights.
This list is precisely the skeleton on which a good policy is written: each point must be tailored to the real practice of the business and formulated in simple, understandable language — the law emphasizes simple language especially where the subject is a minor.
Where Data Are Obtained from Another Source
Where data are not collected directly from the subject, under Article 25 the controller is obliged to provide the information of Article 24 and to notify which data are processed and their source — including whether they were obtained from a publicly available source. This information must be provided within a reasonable period, or — where the data are used to contact the subject — at the first communication, and where disclosure is planned, before the disclosure, but no later than 10 working days from obtaining the data.
The obligation has exceptions: providing the information is not required where the subject already possesses it, where the collection is established by law, or where provision is impossible or requires disproportionate effort and would harm the lawful purpose — in these cases the controller must take appropriate measures, including placing general information publicly.
The Subject's Request and the Deadlines
Under Article 13, the subject has the right to request from the controller confirmation of whether data concerning them are being processed, and to receive free of charge detailed information: which data are processed, the basis and purpose of the processing, the source of collection, the storage period or criteria, their rights, the grounds and guarantees of transfers, the identity of recipients, and the logic of automated decisions. This information is provided no later than 10 working days of the request; in special cases the period may be extended by no more than 10 working days — with justification and immediate notice to the subject.
A well-drafted policy is precisely the readiness to answer these requests: where the information is reflected in the policy from the start, individual requests are satisfied quickly and uniformly; where it is not, every request becomes a separate administrative process.
Liability for Failure to Inform
The failure to perform the duty to inform ends in a fine: under Article 74, a violation of the obligations provided by Articles 24 and 25 entails a warning or a fine — up to 1 000 GEL for subjects with an annual turnover not exceeding 500 000 GEL, and up to 1 500 GEL for legal persons whose turnover exceeds 500 000 GEL; under aggravating circumstances — respectively up to 2 000 and 3 000 GEL.
The nature of the duty also matters: this is not a single technical clause whose breach concerns only an individual case — a lack of information directly harms transparency, and transparency is precisely the value on which the policy is built.
Frequently Asked Questions
What is the minimum content of a policy?
The list of Article 24: identity and contacts, purposes and basis, the mandatory nature of provision and the consequences, legitimate interests, the protection officer, recipients, transfers, storage period and rights.
What happens where data are obtained indirectly?
Under Article 25, the same information plus the scope of processed data and the source must be communicated no later than 10 working days from obtaining, save for the exceptions.
Within what time does the controller answer a request?
Under Article 13 — within 10 working days, extendable by another 10 working days with justification and immediate notice.
What fine exists for failing to inform?
Under Article 74 — a warning or a fine of up to 1 000-1 500 GEL; under aggravating circumstances — up to 2 000-3 000 GEL depending on turnover.
How We Help on Legal.ge
Drafting a privacy policy is the balance of two demands: legality — reflecting every element provided by Articles 24, 25 and 13 — and comprehensibility, formulation in simple language. Without the first the policy is unlawful; without the second it is useless: a document the subject cannot read does not count as information.
The lawyers working on Legal.ge will help you prepare the draft policy, audit existing documents, inventory processing processes and tailor the forms. Contact us for a consultation — a good policy solves with one document what would otherwise demand a thousand requests.