Georgia

Article 2 applies the Law to processing carried out wholly or partly by automated means within Georgia, and to a controller not established in Georgia that uses technical means available in Georgia. Article 34 requires such a controller or processor to appoint or designate a special representative in Georgia before processing begins; the obligation does not apply to entities founded in EU member states or in states recognised by the EU as providing adequate protection. Order No 20 of 28 February 2024 sets the registration procedure: identity and corporate documents, the written appointment agreement, and a description of the technical means used, verified within 10 working days, with a further 5 or 10 working days for corrections. Controllers that already had a representative when the Law started had until 1 April 2024 to register. That order was amended by Order No 004 of the Auditor General of the State Audit Service, published 31 March 2026.

Article 37(1) allows transfer where the Law's processing requirements and appropriate safeguards in the destination are in place. Article 37(2) adds alternatives: an international treaty, an agreement between controllers containing appropriate safeguards together with a permit from the supervisory body, criminal-procedure grounds, the written consent of the person after disclosure of the risks, vital interests, and a narrow proportionate public-interest ground. Article 38 makes the supervisory body assess adequacy of a state or international organisation and set it out in a normative act, reviewed at least once every three years. Sector by sector as checked on 18 August 2026: banking, payments, insurance and securities — no localisation rule found in the National Bank of Georgia's published acts, though its acts portal is not machine-readable and this is recorded as unconfirmed; health — no localisation rule found, but medical institutions are on the list of bodies that must appoint a data protection officer; telecom — content of communications must be destroyed immediately, while connection identification data may be copied by the state into a central database held in Georgia; government and critical infrastructure — the Information Security Law imposes security duties but no storage location; education, gaming, mapping and defence — no localisation rule found.

Article 38(1) requires the supervisory body to assess adequacy by looking at the destination's international obligations, its data protection legislation, the guarantees for people's rights including effective remedies, its onward-transfer rules, and whether it has an independent supervisory authority. The list must be reviewed at least every three years and revised when a destination no longer qualifies. Since 2 March 2026 the assessing body named in the Law is the State Audit Office, and the normative act is issued by the Auditor General. No published adequacy list was locatable on an official Georgian domain during this run.

The text of the Law dated 17 December 2025 carries the substitution in brackets marked to take effect on 2 March 2026: every reference to the Personal Data Protection Service becomes the State Audit Office of Georgia. The original 2023 text named the Personal Data Protection Service in the same articles, which rules out a translation error. Corroboration comes from the subordinate rules: Order No 22 on data protection officers was amended by Order No 005 of the Auditor General of the State Audit Service on 30 March 2026, and Order No 20 on registering foreign companies' representatives by Order No 004, both published 31 March 2026. Rating: waking, not active — the rule-making machine is running, but no published decisions, fines or inspection results from the new supervisor could be verified on an official domain during this run. Sector regulators are separately operational: the National Bank of Georgia, the Georgian National Communications Commission and the Digital Governance Agency, which runs the national computer emergency response team.

Article 4(1)(e) of the Law on Personal Data Protection sets the ceiling: data may be stored only for the period necessary to achieve the legitimate purpose, and must then be erased, destroyed or de-identified unless retention is required by law. Article 8(5) of the Law on Electronic Communications requires that the content of a user's communication be immediately and automatically destroyed. Article 8-3 of the same law lets the authorised body copy the databases of electronic communication identification data into a central bank of that data; the retention period is fixed by Article 15(1) of the Law on the Legal Entity under Public Law called Operative and Technical Agency of Georgia, which we could not open during this run. Where a specific retention law conflicts with the general delete-when-done duty, the specific law wins, because Article 4 expressly carves out retention required by legislation.

Article 29(1) of the Law on Personal Data Protection sets the 72-hour clock and requires the incident, its consequences and the measures taken to be registered. There is a carve-out where it is least expected that the incident would cause significant damage or a significant threat to fundamental rights. Order No 19 of 28 February 2024, in force from 1 March 2024, sets out how to judge that: it looks at the type of data, whether children or disabled people are affected, how easily people can be identified, and the scale, and it requires notification where the likelihood of significant damage is medium or high. Staged reporting is allowed where a full assessment is impossible within 72 hours. A processor must tell its controller immediately. Separately, Article 10 of the Law on Information Security requires that the national computer emergency response team be notified immediately of an identified computer incident and that evidence be preserved.

1) The English text of the Law on the government's own site now reads 'State Audit Office' in the articles on breach notification and international transfer, where the 2023 original read 'Personal Data Protection Service'. Anyone comparing an old summary with the current text will think they are reading two different laws. 2) Article 34 and Order No 20: registration first, processing second; the exemption covers only EU-established entities and entities in EU-recognised adequate countries. 3) Article 7(1): a person aged 16 or over may consent for themselves; under 16 needs a parent or guardian, unless a specific law says otherwise. 4) Article 12(1): data may be processed for direct marketing only with the person's consent, irrespective of how the data was originally collected. 5) Under the Foreign Agents Registration Act, in force 31 May 2025, persons acting for a foreign principal must file identity, address, employment, contract, funding and spending details within 10 days and update every six months, and the filings go into a publicly searchable, downloadable database; enforcement moved from the Anti-Corruption Bureau to the State Audit Office in March 2026. 6) A quieter one: banks, insurers, microfinance organisations, credit bureaus, telecoms companies, airlines, airports, medical institutions and all public bodies must appoint a data protection officer regardless of size.

Dormant switches to watch. First, the list of approved destination countries: the supervisory body sets it by its own normative act, must review it at least every three years, and may revise it whenever a destination stops qualifying — a country can be removed with no consultation and no parliamentary step. Second, the permit route for transfers is discretionary, so the practical bar can be raised without changing the text. Third, the government approves the list of critical information system subjects by ordinance, so an ordinary private company can be pulled into the security regime overnight. Fourth, the two remaining 2024 orders, on data protection impact assessments and on incident notification, can be rewritten by the Auditor General alone. Also worth watching, but not a date: Georgia's supervisory authority is no longer a dedicated independent body, which is in tension with the independence expectations of the Council of Europe data protection convention and of European Union accession — any external assessment of Georgia's protection level could shift because of it.