Georgia

Article 2 applies the Law to data handled wholly or partly by automated means within Georgia. It also applies to a company outside Georgia that uses equipment available in Georgia. Article 34 makes such a company appoint or designate a special representative in Georgia before it starts. That duty does not apply to bodies founded in EU member states. It also does not apply to bodies in states the European Union recognises as giving good enough protection. Order No 20 of 28 February 2024 sets the registration steps. You file identity and corporate documents, the written appointment agreement, and a description of the equipment used. Checks take 10 working days, with a further 5 or 10 working days for corrections. Companies that already had a representative when the Law started had until 1 April 2024 to register. That order was amended by Order No 004 of the Auditor General of the State Audit Service, published 31 March 2026.

Article 37(1) allows a transfer where the Law's requirements are met and the destination has proper safeguards. Article 37(2) adds other routes. One is an international treaty. One is an agreement between companies with proper safeguards, plus a permit from the regulator. Others are criminal procedure grounds, and the written consent of the person after being told the risks. The last two are vital interests, and a narrow proportionate public interest ground. Article 38 makes the regulator assess whether a country or international organisation gives good enough protection. It must set that out in a formal act and review it at least once every three years. Industry by industry, checked on 18 August 2026. BANKING, PAYMENTS, INSURANCE AND SECURITIES. We found no rule forcing data to stay in Georgia in the National Bank of Georgia's published acts. Its acts portal is not machine-readable, so we record this as unconfirmed. HEALTH. We found no rule forcing data to stay in Georgia. But medical institutions are on the list of bodies that must appoint a data protection officer. TELECOM. The content of communications must be destroyed immediately. Connection identification data may be copied by the state into a central database held in Georgia. GOVERNMENT AND CRITICAL INFRASTRUCTURE. The Information Security Law sets security duties. It says nothing about where you store data. EDUCATION, GAMING, MAPPING AND DEFENCE. We found no rule forcing data to stay in Georgia.

Article 38(1) makes the regulator assess whether a destination gives good enough protection. It looks at the destination's international commitments and its data protection laws. It looks at the guarantees for people's rights, including real ways to complain. It also looks at the onward-transfer rules and whether the destination has an independent regulator. The list must be reviewed at least every three years. It must be revised when a destination no longer qualifies. Since 2 March 2026 the assessing body named in the Law is the State Audit Office, and the Auditor General issues the formal act. We could not find any published list on an official Georgian website.

The text of the Law dated 17 December 2025 carries the swap in brackets, marked to take effect on 2 March 2026. Every reference to the Personal Data Protection Service becomes the State Audit Office of Georgia. The original 2023 text named the Personal Data Protection Service in the same articles. That rules out a translation error. The subordinate rules back this up. Order No 22 on data protection officers was amended by Order No 005 of the Auditor General of the State Audit Service on 30 March 2026. Order No 20 on registering foreign companies' representatives was amended by Order No 004. Both were published 31 March 2026. Rating: waking, not active. The rule-making machine is running. But we could not verify any published decisions, fines or inspection results from the new regulator on an official website. Industry regulators are separately working. They are the National Bank of Georgia and the Georgian National Communications Commission. The Digital Governance Agency also runs the national computer emergency response team.

Article 4(1)(e) of the Law on Personal Data Protection sets the maximum. You may store data only for the period needed to achieve the legitimate purpose. Then you must erase, destroy or de-identify it, unless a law requires you to keep it. Article 8(5) of the Law on Electronic Communications requires the content of a user's communication to be destroyed immediately and automatically. Article 8-3 of the same law lets the authorised body copy operators' databases of electronic communication identification data into a central bank of that data. The keeping period is fixed by Article 15(1) of the Law on the Legal Entity under Public Law called Operative and Technical Agency of Georgia. We could not open that law. Where a specific keeping law clashes with the general delete-when-done duty, the specific law wins. Article 4 expressly excludes retention that legislation requires.

Article 29(1) of the Law on Personal Data Protection sets the 72-hour clock. You must also record the incident, its consequences and the steps you took. There is an exception where significant damage or a significant threat to fundamental rights is least expected. Order No 19 of 28 February 2024, in force from 1 March 2024, sets out how to judge that. It looks at the type of data. It looks at whether children or disabled people are affected. It looks at how easily people can be identified, and at the scale. It requires you to notify where the likelihood of significant damage is medium or high. You can report in stages where you cannot finish the assessment within 72 hours. A supplier handling data on your behalf must tell you immediately. Separately, Article 10 of the Law on Information Security requires you to notify the national computer emergency response team immediately of an identified computer incident. You must also preserve the evidence.

1) The English text of the Law on the government's own site now reads 'State Audit Office' in the articles on breach notification and international transfer. The 2023 original read 'Personal Data Protection Service' there. Anyone comparing an old summary with the current text will think they are reading two different laws. 2) Article 34 and Order No 20: register first, handle data second. The exemption covers only bodies established in the European Union, and bodies in countries the European Union treats as giving good enough protection. 3) Article 7(1): a person aged 16 or over may consent for themselves. Under 16 needs a parent or guardian, unless a specific law says otherwise. 4) Article 12(1): you may use data for direct marketing only with the person's consent. It does not matter how you originally collected the data. 5) Under the Foreign Agents Registration Act, in force 31 May 2025, anyone acting for a foreign principal must file details within 10 days. That means identity, address, employment, contract, funding and spending. They must update every six months. The filings go into a publicly searchable, downloadable database. Enforcement moved from the Anti-Corruption Bureau to the State Audit Office in March 2026. 6) A quieter one. Banks, insurers, microfinance organisations, credit bureaus, telecoms companies, airlines, airports, medical institutions and all public bodies must appoint a data protection officer. Size does not matter.

THINGS THAT CAN CHANGE WITH NO CONSULTATION. First, the list of approved destination countries. The regulator sets it by its own formal act. It must review the list at least every three years. It may revise it whenever a destination stops qualifying. A country can be removed with no consultation and no step through parliament. Second, the permit route for transfers is discretionary. So the bar can be raised without changing the text of the law. Third, the government approves the list of critical information system subjects by ordinance. So an ordinary private company can be pulled into the security rules overnight. Fourth, the two remaining 2024 orders can be rewritten by the Auditor General alone. Those cover data protection impact assessments and incident notification. Also worth watching, but not a date. Georgia's regulator is no longer a dedicated independent body. That sits awkwardly with the independence expected by the Council of Europe data protection convention, and by European Union accession. Any outside assessment of Georgia's protection level could shift because of it.