Does the institution of standard contractual clauses exist in Georgia
In international practice, standard contractual clauses are known as a European mechanism for data transfers — a set of pre-approved template conditions. One thing must be said plainly at the outset of this page: Georgian legislation contains no separate instrument of such approved standard conditions. Instead, Articles 37 and 38 of the Georgian Law on Personal Data Protection create a functionally similar but distinct mechanism: contractual guarantees with the permission of the supervisory authority.
This distinction matters practically: simply transposing foreign templates into a Georgian contract does not automatically ensure lawfulness. The Georgian law requires going through its own procedure — and it is precisely the steps of that procedure that this page explains.
The mechanism of contractual guarantees
Under the general rule of the first paragraph of Article 37, the transfer of data to another state and to an international organisation is admissible where the requirements provided for by law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state or organisation. Where this general condition is not satisfied, the relevant subparagraph of the second paragraph offers a way out: transfer is admissible where the controller ensures appropriate guarantees of data protection by a contract concluded between the controller and the corresponding state, its competent public agency, a legal or natural person or an international organisation.
The central element of this mechanism is permission. Transfer on the basis of a contract is possible only after obtaining the permission of the State Audit Office, the issuing procedure of which is established by a normative act of the General Auditor. This means that the contract alone is not sufficient: it requires the prior consent of the supervisory authority.
What conditions the contract must contain
The law formulates a clear requirement regarding the content of the contract: the agreement on such a transfer must contain binding conditions with mandatory legal force that are enforceable. In other words, the conditions must not be declarative — they must have a genuinely enforceable character, so that the data subject and the supervisory authority can rely on them to demand protection.
In addition, in any permitted case of transfer the controller is obliged to adopt the organisational and technical measures necessary for the secure transfer of data. The onward transfer to a third party is admissible only where it serves the original purposes and satisfies the same grounds and appropriate guarantees. This last rule should be reflected directly in the contract; otherwise the data end up outside any control.