Does the institution of standard contractual clauses exist in Georgia
In international practice, standard contractual clauses are known as a European mechanism for data transfers — a set of pre-approved template conditions. One thing must be said plainly at the outset of this page: Georgian legislation contains no separate instrument of such approved standard conditions. Instead, Articles 37 and 38 of the Georgian Law on Personal Data Protection create a functionally similar but distinct mechanism: contractual guarantees with the permission of the supervisory authority.
This distinction matters practically: simply transposing foreign templates into a Georgian contract does not automatically ensure lawfulness. The Georgian law requires going through its own procedure — and it is precisely the steps of that procedure that this page explains.
The mechanism of contractual guarantees
Under the general rule of the first paragraph of Article 37, the transfer of data to another state and to an international organisation is admissible where the requirements provided for by law exist and appropriate guarantees of data protection and of the protection of the subject's rights are ensured in the corresponding state or organisation. Where this general condition is not satisfied, the relevant subparagraph of the second paragraph offers a way out: transfer is admissible where the controller ensures appropriate guarantees of data protection by a contract concluded between the controller and the corresponding state, its competent public agency, a legal or natural person or an international organisation.
The central element of this mechanism is permission. Transfer on the basis of a contract is possible only after obtaining the permission of the State Audit Office, the issuing procedure of which is established by a normative act of the General Auditor. This means that the contract alone is not sufficient: it requires the prior consent of the supervisory authority.
What conditions the contract must contain
The law formulates a clear requirement regarding the content of the contract: the agreement on such a transfer must contain binding conditions with mandatory legal force that are enforceable. In other words, the conditions must not be declarative — they must have a genuinely enforceable character, so that the data subject and the supervisory authority can rely on them to demand protection.
In addition, in any permitted case of transfer the controller is obliged to adopt the organisational and technical measures necessary for the secure transfer of data. The onward transfer to a third party is admissible only where it serves the original purposes and satisfies the same grounds and appropriate guarantees. This last rule should be reflected directly in the contract; otherwise the data end up outside any control.
The adequacy assessment and the list
Article 38 determines how the existence of guarantees in another state or international organisation is assessed. This assessment is borne by the State Audit Office and rests on an analysis of international obligations, regulatory legislation, guarantees for the protection of the subject's rights, rules for onward transfer, and the existence of an independent supervisory authority. The list of states and organisations where guarantees are ensured is determined by a normative act of the General Auditor.
The list has a dynamic character: it must be reviewed at least once every 3 years, and where a state or organisation no longer satisfies the conditions, changes must be made to the list — though such changes have no retroactive effect. The practical conclusion: when using the list as a ground for transfer, the currency of the list must be checked at every update of the document.
How to run the process in practice
The sequence for a transfer relying on contractual guarantees is as follows. First: checking whether the recipient country is on the adequacy list — if it is, the contractual mechanism is not used at all and the general rule operates. Second: if it is not, drafting the contract conditions, which must cover binding enforceable conditions and reflect the restrictions on onward transfer. Third: defining the organisational and technical security measures. Fourth: requesting permission from the State Audit Office. Fifth: carrying out the transfer only after permission is obtained and recording it in the processing records.
The Legal.ge team will help you use this mechanism correctly: from preparing contract conditions to requesting permission — so that your international transfers rest on the precise requirements of Georgian law and not merely on foreign templates.
The assessment criteria are written in the law itself: the State Audit Service analyses the international obligations and regulatory legislation connected with data protection, the guarantees of protection of the data subject's rights and freedoms — including effective legal-remedy mechanisms — the rules on further international transfer of data, and the existence, powers and activity of an independent supervisory authority. The corresponding list is defined by a normative act of the Auditor General and must be reviewed at least once every 3 years; where a state or organization no longer satisfies the conditions, the list must be amended, but the amendments carry no retroactive effect — the legal basis of transfers founded earlier does not collapse by the amendment.
Frequently Asked Questions
Below we answer the questions most frequently asked about international data transfers.
Who assesses the adequacy of safeguards?
The State Audit Service — on the basis of an analysis of international obligations, rights-protection mechanisms, onward-transfer rules and independent supervision.
How is the list reviewed?
At least once every 3 years; amendments carry no retroactive effect.
May data be passed on to a third party?
Only where the onward transfer serves the initial purposes and satisfies the grounds and appropriate safeguards.
How We Help on Legal.ge
The mechanism of contractual guarantees demands precise documentation and knowledge of which jurisdictions are on the list. The Legal.ge team will assess your transfer within the frame of the legislation in force, prepare contractual guarantees and assist in relations with the State Audit Service. Write to us on Legal.ge — your transfer will proceed on a sound basis.