The submission of an access request by a data subject looks like a simple step, but for the organisation it rests on a clear legal procedure. This page deals precisely with the mechanics of the request: within which deadlines, at which fee, with which exceptions and through which appeal route the answer is given. The foundation is Articles 14, 15, 17, 22 and 72 of the Georgian Law on Personal Data Protection.
Unlike other pages, we do not discuss here what information the requester is entitled to receive — that is governed by other norms of the data protection law. The focus is on how the processing of the request works: deadlines, fees, the form of refusal and what happens when the organisation cannot cope with the obligation.
Access deadlines and extension
Under the second paragraph of Article 14, the data subject has the right to examine the data concerning him or her or to receive copies no later than 10 working days from the request, unless another period is established by legislation. In special cases and with proper substantiation this period may be extended by no more than a further 10 working days, of which the subject must be notified immediately. This means that extension is not a silent option: it must be motivated and communicated.
Access is followed by the right to rectification. Under the second paragraph of Article 15, no later than 10 working days from a request for the correction, updating or completion of erroneous, inaccurate or incomplete data, the data must be corrected, updated or completed, or the subject must be notified of the ground for refusal with an explanation of the appeal procedure. Where the organisation itself discovers an error, it corrects the data within a reasonable period and notifies the subject within 10 working days of the correction, unless it concerns the rectification of a technical error.