The submission of an access request by a data subject looks like a simple step, but for the organisation it rests on a clear legal procedure. This page deals precisely with the mechanics of the request: within which deadlines, at which fee, with which exceptions and through which appeal route the answer is given. The foundation is Articles 14, 15, 17, 22 and 72 of the Georgian Law on Personal Data Protection.
Unlike other pages, we do not discuss here what information the requester is entitled to receive — that is governed by other norms of the data protection law. The focus is on how the processing of the request works: deadlines, fees, the form of refusal and what happens when the organisation cannot cope with the obligation.
Access deadlines and extension
Under the second paragraph of Article 14, the data subject has the right to examine the data concerning him or her or to receive copies no later than 10 working days from the request, unless another period is established by legislation. In special cases and with proper substantiation this period may be extended by no more than a further 10 working days, of which the subject must be notified immediately. This means that extension is not a silent option: it must be motivated and communicated.
Access is followed by the right to rectification. Under the second paragraph of Article 15, no later than 10 working days from a request for the correction, updating or completion of erroneous, inaccurate or incomplete data, the data must be corrected, updated or completed, or the subject must be notified of the ground for refusal with an explanation of the appeal procedure. Where the organisation itself discovers an error, it corrects the data within a reasonable period and notifies the subject within 10 working days of the correction, unless it concerns the rectification of a technical error.
The fee: when it is possible and within what limit
As a general rule, examination and the receipt of copies are free of charge. The first paragraph of Article 14, however, names two exceptions: where a fee is provided for by legislation, or where the controller has set a reasonable fee — for the resource expended in providing the data in a form different from the storage form, or because of the frequency of requests.
The law regulates this last case with a clear limit: the fee set must not exceed the amount of the resource actually expended, and the burden of proving the establishment of the fee and the reasonableness of its amount rests on the controller. A fee is therefore not a source of income — it is reimbursement of costs, and proving that lies with the organisation.