Subject access requests: deadlines, fees and escalation
The submission of an access request by a data subject looks like a simple step, but for the organisation it rests on a clear legal procedure. This page deals precisely with the mechanics of the request: within which deadlines, at which fee, with which exceptions and through which appeal route the answer is given. The foundation is Articles 14, 15, 17, 22 and 72 of the Georgian Law on Personal Data Protection.
Unlike other pages, we do not discuss here what information the requester is entitled to receive — that is governed by other norms of the data protection law. The focus is on how the processing of the request works: deadlines, fees, the form of refusal and what happens when the organisation cannot cope with the obligation.
Access deadlines and extension
Under the second paragraph of Article 14, the data subject has the right to examine the data concerning him or her or to receive copies no later than 10 working days from the request, unless another period is established by legislation. In special cases and with proper substantiation this period may be extended by no more than a further 10 working days, of which the subject must be notified immediately. This means that extension is not a silent option: it must be motivated and communicated.
Access is followed by the right to rectification. Under the second paragraph of Article 15, no later than 10 working days from a request for the correction, updating or completion of erroneous, inaccurate or incomplete data, the data must be corrected, updated or completed, or the subject must be notified of the ground for refusal with an explanation of the appeal procedure. Where the organisation itself discovers an error, it corrects the data within a reasonable period and notifies the subject within 10 working days of the correction, unless it concerns the rectification of a technical error.
The fee: when it is possible and within what limit
As a general rule, examination and the receipt of copies are free of charge. The first paragraph of Article 14, however, names two exceptions: where a fee is provided for by legislation, or where the controller has set a reasonable fee — for the resource expended in providing the data in a form different from the storage form, or because of the frequency of requests.
The law regulates this last case with a clear limit: the fee set must not exceed the amount of the resource actually expended, and the burden of proving the establishment of the fee and the reasonableness of its amount rests on the controller. A fee is therefore not a source of income — it is reimbursement of costs, and proving that lies with the organisation.
Blocking as a temporary measure
Article 17 regulates the cases where the subject demands the blocking of data: including where the subject disputes the authenticity or accuracy of the data, or where the processing is unlawful but the subject opposes deletion and requests blocking. Information about the decision on blocking is received by the subject immediately upon its adoption, but no later than 3 working days from the request.
Blocking is an instrument for the period of a dispute: the data are blocked for the period of existence of the ground for blocking. In the practice of access requests this means that a dispute about accuracy does not delete the data — it puts them into a waiting regime until the matter is resolved.
The form of refusal and the routes of appeal
In each case of refusal the law requires the same formula: the subject is notified of the ground for refusal and given an explanation of the appeal procedure. This is not a formality — a refusal without a ground itself becomes a violation.
The routes of appeal are defined by Article 22: in the event of a violation of rights, the subject has the right to apply, in the manner established by law, to the State Audit Office, the court or a superior administrative organ. The subject may also demand from the State Audit Office a decision on blocking the data before the examination of the application is completed, and may appeal the service's decision in court.
Liability
Article 72 attaches a sanction to the violation of the subject's rights provided for by the third chapter. The violation of one right entails a warning or a fine of 1 000 lari for persons with turnover up to 500 000 lari and a warning or a fine of 1 500 lari at higher turnover. The violation of two or more rights — a warning or a fine of 2 000/3 000 lari. With aggravating circumstances the amounts rise to 3 000/5 000 lari.
The Legal.ge team will help you build procedures for processing access requests and prepare answers to individual requests — with precise observance of deadlines, fees and the substantiation of refusals.