Personal Data Protection in Georgia: Current Requirements and International Standards

2.1. Brief Overview of Changes from 2023–2024
Starting from 2023, Georgia introduced amendments to the "Personal Data Protection Law." The main provisions came into effect in March and June 2024, and they are now fully applied by businesses and government authorities.
Key changes include:
●     The requirement to appoint a Data Protection Officer (DPO) in certain organizations;
●     Stricter requirements for consent to marketing and advertising communications;
●     Clear regulations for penalties tied to company turnover;
●     Clarification of the powers of the Service, which is authorized to conduct scheduled and unscheduled inspections and impose fines even for the first detected violation.
No new amendments have been adopted in 2025, but the practice of law enforcement shows that the Service has intensified its supervisory activities, especially in light of the increased number of data leaks.

 2.2. Key Principles of Data Processing
Georgian legislation outlines six basic principles that must be followed when collecting and using personal data:

1. Lawfulness, transparency, fairness. Processing is allowed only if there is a legal basis, and it must be understandable to the data subject.
2. Purpose limitation. Data must be collected exclusively for pre-defined purposes;
3. Data minimization. The amount of processed information should be the minimum necessary;
4. Accuracy and relevance. Operators should regularly update the data and correct inaccuracies;
5. Storage limitation. Once the processing goals are achieved, data must be destroyed or anonymized;
6. Security. Companies and government authorities must take technical and organizational measures to prevent unauthorized access, leaks, or distortion of data.

2.3. Mandatory Data Protection Officer (DPO)

2.3.1. What is a Data Protection Officer (DPO)?
A Data Protection Officer (DPO) is a specialist appointed by an organization to oversee compliance with the law and protect the rights of data subjects. The DPO checks compliance with internal policies, provides recommendations for rectifying violations, ensures communication with the regulator, and responds promptly to incidents involving personal data security.

2.3.2. Key Responsibilities of the DPO
The law and subordinate acts assign the following key functions to the DPO:
●Monitoring compliance with legislation and internal policies. The DPO ensures that all data processing activities comply with both Georgian law and corporate standards;
●     Participation in risk document preparation. The DPO helps identify and assess risks related to data processing, oversees the implementation of internal instructions;
●     Employee training and consulting. The DPO organizes training, explains the rights and obligations of employees in data protection;
●     Interaction with the Service. In case of inspections or requests from the regulator, the DPO is the contact person, providing clarifications and responsible for document submission;
●     Processing requests from data subjects. If a citizen wants to exercise their rights (access, deletion, correction, etc.), the DPO coordinates this process.

2.3.3. When Are Entrepreneurs Required to Have a DPO?
According to legislative amendments, appointing a DPO is mandatory for:
●     Government institutions;
●     Insurance organizations;
●     Commercial banks;
●     Microfinance organizations;
●     Credit bureaus;
●     Electronic communications companies (telecom operators, internet providers, etc.);
●     Airlines and airports;
●     Healthcare institutions;
●     Entities processing large volumes of data (more than 3% of the entire population of Georgia or over 1% of special category data);
●     Entities conducting **systematic and large-scale monitoring.
*Special categories of data include race and ethnic origin, political and religious beliefs, health status, biometric data, and other information that may affect the rights and freedoms of individuals.
**Systematic and large-scale monitoring includes:
●     Tracking internet activity (tracking, creating user profiles);
●     Profiling or assigning scores to assess risks;
●     Monitoring the behavior of children (in kindergartens, schools, universities) or other categories of citizens;
●     Behavioral advertising (based on the collection and analysis of user actions).

2.4. Consent for Marketing Communications and Other Aspects
The law requires obtaining explicit consent from data subjects before sending any marketing messages (email, SMS, messengers). Additionally, the unsubscribe process must be simple and accessible. Failure to comply with these rules may lead to fines, especially in the case of mass mailings.

2.5. Responsibility and Fines
Violations of processing regulations, failure to meet security requirements, failure to appoint a DPO (when mandatory), and other infractions are subject to administrative responsibility. For companies with a turnover of up to 500,000 GEL, fixed fines are established for different types of violations. In cases of serious or repeated violations, the fines increase in proportion to turnover. However, the maximum fine resulting from a single inspection cannot exceed 20,000 GEL.

2.6. Control by the Personal Data Protection Service
The Service actively conducts scheduled and unscheduled inspections. According to official statistics, in 2024, 265 inspections were carried out. Of these, 31% (83) were scheduled, and 69% (182) were unscheduled. The results of the inspections show that the regulator uses its right to impose fines even at the first detected violation, without limiting itself to issuing warnings. This is partly due to the increasing cases of major data leaks and the Service’s intention to prevent even potential risks.