---
title: "Privacy Policy Development"
url: "https://legal.ge/en/service/technology-and-digital-law-en/privacy-policy-development-en"
field: "Technology & Digital Law"
description: "Privacy policy development: mandatory content, information deadlines of 10 working days, fines up to 3 000 GEL. Legal.ge."
reviewed: "2026-02-15"
updated: "2026-11-07"
publisher: "legal.ge"
---

# Privacy Policy Development

> Source: legal.ge, https://legal.ge/en/service/technology-and-digital-law-en/privacy-policy-development-en

## The Content of the Policy — What Must Be Written

A privacy policy is not legal literature but the fulfilment of a statutory list of information. Under Article 24, where data are collected directly from the data subject, the controller is obliged, before collection or at its start, to provide at least the following: the identity and contact information of the controller, its representative or the processor; the purposes and the legal basis of the processing; whether the provision of data is mandatory and the consequences of refusal; the significant legitimate interests; the identity of the data protection officer, where one exists; the recipient or categories of recipients; the planned transfer to another state; the storage period or the criteria for determining it; and the subject's rights.

This list is precisely the skeleton on which a good policy is written: each point must be tailored to the real practice of the business and formulated in simple, understandable language — the law emphasizes simple language especially where the subject is a minor.

## Where Data Are Obtained from Another Source

Where data are not collected directly from the subject, under Article 25 the controller is obliged to provide the information of Article 24 and to notify which data are processed and their source — including whether they were obtained from a publicly available source. This information must be provided within a reasonable period, or — where the data are used to contact the subject — at the first communication, and where disclosure is planned, before the disclosure, but no later than 10 working days from obtaining the data.

The obligation has exceptions: providing the information is not required where the subject already possesses it, where the collection is established by law, or where provision is impossible or requires disproportionate effort and would harm the lawful purpose — in these cases the controller must take appropriate measures, including placing general information publicly.

The full text is available on legal.ge after signing in: https://legal.ge/en/service/technology-and-digital-law-en/privacy-policy-development-en

### What is the minimum content?

The list of Article 24: identity and contacts, purposes and basis, mandatory provision, protection officer, recipients, storage period and rights.

### What about indirectly obtained data?

Under Article 25, the same information plus the source; communicated no later than 10 working days from obtaining, save exceptions.

### How quickly must a controller answer?

Within 10 working days, extendable by a further 10 working days with justification and immediate notice (Article 13).

### What fine for non-information?

A warning or up to 1 000-1 500 GEL; under aggravating circumstances up to 2 000-3 000 GEL by turnover (Article 74).