LAW OF GEORGIA ON PERSONAL DATA PROTECTION

Law of Georgia

On Personal Data Protection

Article 1. Purpose of the Law The purpose of this Law is the protection of fundamental human rights and freedoms, including the rights to inviolability of personal and family life, personal space and communication, in the processing of personal data.🔗

Article 2. Scope of the Law 1. This Law shall apply to the processing of data by automatic means and processing by semi-automatic means on the territory of Georgia, to the processing by non-automatic means of data that are part of a filing system or are processed for entry into a filing system, as well as to the processing of data by a person responsible for processing registered outside the territory of Georgia using technical means located in Georgia, except where the technical means are used only for data transit.🔗

2. This Law shall not apply to:

a) processing of data by a natural person clearly for personal purposes and/or within the framework of family activity, which is not related to his/her entrepreneurial and/or economic, professional activity or the performance of official duties. Processing of data for personal purposes and/or within the framework of family activity may include, among other things, correspondence, processing of addresses, Internet activity (including on a social network), which is carried out within the framework of this activity;

b) processing of data for the purposes of state security (including economic security), defence, intelligence and counter-intelligence activities;

c) processing by semi-automatic means and processing by non-automatic means of data classified as state secrets for the purposes of crime prevention, investigation, criminal prosecution, operational-search measures and maintenance of law and order;

d) processing of data for the purposes of legal proceedings in court;

e) processing of data by the mass media for the purpose of informing the public (except for subparagraph “f” of paragraph 1 of Article 4 and Article 27 of this Law);

f) processing of data for academic, artistic and literary purposes.

3. Article 6 of this Law shall not apply to the processing of data for the purposes of a population census provided for by the Law of Georgia on Official Statistics.

4. This Law shall apply to the processing of data by automatic means and processing by semi-automatic means by institutions carrying out the activities defined by subparagraphs “b”–“d” of paragraph 2 of this Article, to the processing by non-automatic means of data that are part of a filing system or are processed for entry into a filing system, if the data are not processed directly within the framework of the activities defined by the same subparagraphs.

5. Any person who unintentionally receives data of another person that are not intended for him/her shall respect the rights of the data subject and shall not attempt unlawful processing of the data.

Article 3. Definition of terms For the purposes of this Law, the terms used herein have the following meaning:🔗

a) personal data (hereinafter – data) – any information relating to an identified or identifiable natural person. A natural person is identifiable when it is possible to identify them directly or indirectly, including by name, surname, identification number, geolocation data, electronic communication identifying data, physical, physiological, mental, psychological, genetic, economic, cultural or social characteristics;

b) special category data – data relating to a natural person's racial or ethnic origin, political views, religious, philosophical or other beliefs, trade union membership, health, sexual life, the status of an accused, convicted, acquitted or victim in criminal proceedings, conviction, criminal record, diversion, recognition as a victim of a crime in accordance with the Law of Georgia on Combating Trafficking in Human Beings (Trafficking) or the Law of Georgia on Combating Violence against Women and/or Domestic Violence, Protection of and Assistance to Victims of Violence, imprisonment and execution of a sentence against them, as well as biometric and genetic data processed for the purpose of unique identification of a natural person;

c) health-related data – data concerning the physical or mental health of the data subject, as well as information on the provision of medical services to them, if it provides information about the physical or mental health of the data subject;

d) biometric data – data processed by means of technical means, relating to the physical, physiological or behavioural characteristics of the data subject (such as, for example: facial image, voice characteristic or dactyloscopic data), which allows for their unique identification or verification of identity;

e) genetic data – acquired or inherited genetic characteristics of the data subject which, through analysis of biological material, provides unique information about their physiology or health;

f) data processing – any operation performed on data, including their collection, acquisition, access to them, photographing them, video monitoring and/or audio monitoring, organisation, grouping, interconnection, storage, alteration, recovery, retrieval, use, blocking, erasure or destruction, as well as disclosure of data by transferring, publicising, disseminating them or otherwise making them available;

g) processing of data by automatic means – data processing using information technologies;

h) processing of data by non-automatic means – data processing without the use of information technologies;

i) processing of data by semi-automatic means – data processing through the joint use of automatic means and non-automatic means;

j) file system − a structured set of data in which they are arranged and accessible according to specific criteria;

k) data subject − any natural person about whom data is processed;

l) consent of the data subject − the will of the data subject, freely and clearly expressed by active action, in writing (including electronically) or orally, to the processing of data about him/her for a specific purpose, after receiving the relevant information;

m) written consent of the data subject − consent signed by the data subject or otherwise expressed by him/her in writing (including electronically) to the processing of data about him/her for a specific purpose, after receiving the relevant information;

n) person responsible for processing − a natural person, legal person or public institution which, individually or together with others, determines the purposes and means of data processing, and carries out data processing directly or through a person authorised to process;

o) persons jointly responsible for processing − two or more persons responsible for processing which jointly determine the purposes and means of data processing;

p) person authorised to process − a natural person, legal person or public institution which processes data for the person responsible for processing or on his/her behalf. A natural person in an employment relationship with the person responsible for processing shall not be considered a person authorised to process;

q) data recipient − a natural person, legal person or public institution to which the data were transferred, except the State Audit Office;

r) category of data recipient − classification/grouping of data recipients according to the field of activity or organisational-legal form;

s) third party − a natural person, legal person or public institution, except the data subject, the State Audit Office, the person responsible for processing, the person authorised to process, the special representative and the person who is authorised to process data under the direct instruction of the person responsible for processing or the person authorised to process;

t) special representative − a natural person or legal person registered outside the borders of Georgia, designated/appointed as a representative by the person responsible for processing or the person authorised to process on the basis of this Law, as well as an association of persons without legal status;

u) personal data protection officer − a person designated/appointed by the person responsible for processing or the person authorised to process, who performs the functions provided for by Article 33 of this Law;

v) blocking of data − temporary suspension of data processing (except storage);

w) Video monitoring − processing of visual image data through the use of technical means placed/installed in public or private space, in particular, video control and/or video recording (except for covert investigative action);

x) Audio monitoring − processing of sound signal data through the use of technical means placed/installed in public or private space, in particular, audio control and/or audio recording (except for covert investigative action);

y) Direct marketing − direct and immediate provision of information to a data subject by telephone, post, electronic mail or other electronic means for the purpose of forming, maintaining, realizing and/or supporting interest in a natural person and/or a legal person, goods, an idea, a service, work and/or an undertaking, as well as in image-related and social themes. The provision of information by a state institution to a natural person shall not be considered direct marketing if such provision of information is compatible with any of the grounds for data processing provided for by Articles 5 and 6 of this Law;

z) Profiling − any form of automated data processing which implies the use of data to evaluate certain personal characteristics related to a natural person, in particular, the analysis and prediction of those characteristics which concern the quality of performance of work by the natural person, his/her economic situation, health, personal interests, reliability, behaviour, place of location or movement;

aa) Depersonalization of data − such processing of data where it is impossible to link them to a data subject or the establishment of such a link requires disproportionately large effort, costs and/or time;

bb) Pseudonymization of data − such processing of data where, without the use of additional information, it is impossible to link the data to a specific data subject and this additional information is stored separately and, through technical and organizational measures, the data are not linked to an identified or identifiable natural person;

cc) Incident − a breach of data security which causes unlawful or accidental damage to, loss of data, as well as unauthorized disclosure, destruction, alteration of, access to, collection/obtaining of, or other unauthorized processing of data;

dd) Public institution − an institution defined by subparagraph „a“ of Article 27 of the General Administrative Code of Georgia (except for political and religious associations);

ee) Continuing offence − an offence provided for by this Law, the commission of which begins with an act and which is thereafter continuously carried out. A continuing offence is completed from the moment of cessation of the act;

ff) Covert investigative action − an investigative action provided for by paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia;

gg) Agency – a body with the exclusive authority to conduct covert investigative actions provided for by subparagraphs „a“–„d“ of paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia – Legal Entity of Public Law – Operational-Technical Agency of Georgia;

gg¹) electronic control system – the system provided for by subparagraph „i“ of Article 2 of the Law of Georgia „On the Legal Entity of Public Law – Operational-Technical Agency of Georgia“;

gg²) special electronic control system – the system provided for by subparagraph „j“ of Article 2 of the Law of Georgia „On the Legal Entity of Public Law – Operational-Technical Agency of Georgia“;

gg³) electronic control system of the central bank of electronic communication identifying data – the system provided for by subparagraph „k“ of Article 2 of the Law of Georgia „On the Legal Entity of Public Law – Operational-Technical Agency of Georgia“;

gg⁴) special electronic control system for real-time geolocation determination – the system provided for by subparagraph „n“ of Article 2 of the Law of Georgia „On the Legal Entity of Public Law – Operational-Technical Agency of Georgia“.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 4. Principles of Data Processing1. The following principles shall be observed when processing data:🔗

a) Data shall be processed lawfully, fairly, transparently for the data subject and without infringing his/her dignity. The obligation of transparency of data processing shall not apply to exceptional cases established by this Law;

b) Data shall be collected/obtained only for specific, clearly defined and legitimate purposes. Further processing of data for another purpose incompatible with the initial purpose of data processing shall be prohibited;

c) Data shall be processed only to the extent necessary to achieve the relevant legitimate purpose. Data shall be proportionate to the purpose for which they are processed;

d) Data shall be true, accurate and, where necessary, updated. Taking into account the purposes of data processing, inaccurate data shall be rectified, erased or destroyed without unjustified delay;

e) Data may be stored only for the period necessary to achieve the relevant legitimate purpose of data processing. After achievement of the purpose for which the data are processed, they shall be erased, destroyed or stored in depersonalized form, except where data processing is determined by law and/or a sub-legislative normative act issued in accordance with law and the storage of data is a necessary and proportionate measure for the protection of overriding interests in a democratic society;

f) For the purpose of protecting data security, when processing data, such technical and organizational measures shall be taken as properly ensure the protection of data, including against unauthorized or unlawful processing, accidental loss, destruction and/or damage.

2. If data are to be processed for a purpose different from the purpose of their collection/obtaining and the processing is not carried out with the consent of the data subject or on the basis of law, when deciding the issue of data processing for a purpose different from the purpose of data collection/obtaining, the person responsible for processing shall take into account:

a) whether there is a connection between the initial purpose of data collection/obtaining and the subsequent purpose;

b) the nature of the relationship existing between the person responsible for processing and the data subject at the time of data collection/obtaining;

c) whether the data subject has a reasonable expectation of further processing of data concerning him/her;

d) whether processing of special categories of data is carried out;

e) the possible consequences for the data subject that may accompany further processing of data;

f) the existence of technical and organizational security measures for data.

3. Data collected by a law enforcement body within the scope of its activities may be processed for the purpose of general analysis of criminal activity and establishing links between various detected crimes.

4. For the purpose of ensuring compliance with the data processing principle provided for by subparagraph “d” of paragraph 1 of this Article, the person responsible for processing shall, depending on the context, distinguish data based on facts from data based on personal assessment. In relation to data based on personal assessment, strict compliance with the data processing principle provided for by subparagraph “d” of paragraph 1 of this Article shall not be mandatory.

5. Subsequent processing of data by the person responsible for processing for the purposes of prevention of crime (including appropriate analytical research), investigation of crime, criminal prosecution, administration of justice, execution of detention and imprisonment, execution of non-custodial sentences and probation, ensuring the placement of a person in a temporary detention isolator, combating illegal migration, implementation of international protection, responding to administrative offences, ensuring civil and fire safety, operative-investigative activity, protection of public safety and/or public order (including the conduct of criminological research by the relevant law enforcement body or court) shall not be considered incompatible with the initial purpose of data processing, if the data processing is provided for by law or by a law and a subordinate normative act issued on its basis.

6. Subsequent processing of data for archiving in accordance with public interests, scientific or historical research or statistical purposes shall not be considered incompatible with the initial purpose of data processing. Long-term storage of data for the purpose provided for by this paragraph shall be permissible if appropriate technical and organisational security measures have been taken to protect the rights of the data subject.

7. The person responsible for processing shall be responsible for compliance with the principles defined by this Article during data processing and shall be able to substantiate compliance therewith.

Article 5. Grounds for Data Processing 1. Data processing shall be permitted if one of the following grounds exists:🔗

a) the data subject has given consent to the processing of data concerning him/her for one or more specific purposes;

b) data processing is necessary for the performance of an obligation assumed under a transaction concluded with the data subject or in order to conclude a transaction at the request of the data subject;

c) data processing is provided for by law;

d) data processing is necessary for the performance of duties imposed on the person responsible for processing by the legislation of Georgia;

e) in accordance with the law, the data is publicly available or the data subject has made it publicly available;

f) data processing is necessary in order to protect the vital interests of the data subject or another person, including for monitoring an epidemic and/or preventing its spread, and for managing humanitarian crises, natural and human-induced disasters;

g) data processing is necessary in order to protect an important public interest;

h) data processing is necessary for the performance of tasks assigned to the field of public interest defined by the legislation of Georgia, including for the purposes of prevention of crime, investigation of crime, criminal prosecution, administration of justice, execution of detention and imprisonment, execution of non-custodial sentences and probation, operative-investigative activity, public safety, protection of law and order, including ensuring information security and cyber security;

i) data processing is necessary in order to protect the important legitimate interests of the person responsible for processing or of a third party, except where there is an overriding interest in protecting the rights of the data subject (including a minor);

j) data processing is necessary for the consideration of the data subject's application (in order to provide a service to him/her).

2. The obligation to substantiate the legal basis for data processing shall rest with the person responsible for processing.

Article 6. Processing of Special Category Data 1. The processing of special category data shall be permitted only if the guarantees for the protection of the rights and interests of the data subject provided for by this Law are ensured by the person responsible for the processing and one of the following grounds exists:🔗

a) the data subject has given written consent to the processing of special category data for one or more specific purposes;

b) the processing of special category data is directly and specifically regulated by law and their processing is a necessary and proportionate measure in a democratic society;

c) the processing of special category data is necessary in order to protect the vital interests of the data subject or of another person and the data subject is physically or legally incapable of giving consent to the processing of special category data;

d) the processing of special category data is necessary in the field of health protection for the purposes of preventive, prophylactic, diagnostic, therapeutic, rehabilitation and palliative care, services, the quality and safety of medical devices and products, public health and the management of the health protection system, in accordance with the legislation of Georgia or a contract concluded with a health protection specialist (if these data are processed by a person who bears the obligation to protect professional secrecy);

e) the processing of special category data is necessary in the field of social security and social protection, including for the management of the social security system and services, in order to fulfil an obligation imposed by the legislation of Georgia on the person responsible for the processing or to exercise specific rights of the data subject;

f) the processing of special category data is necessary for the purposes of the prevention of crime (including appropriate analytical research), the investigation of crime, criminal prosecution, the administration of justice, the execution of detention and imprisonment, the execution of non-custodial sentences and probation, ensuring the placement of a person in a temporary detention isolator, combating illegal migration, the implementation of international protection, responding to administrative offences, ensuring civil and fire safety, operative-investigative activity, the protection of public security and/or law and order (including the conduct of criminological research by the relevant law enforcement body or court), and the processing of these data is provided for by the relevant law or by a law and a subordinate normative act issued on its basis;

g) special category data are processed in order to ensure information security and cyber security;

h) the processing of special category data is necessary arising from the nature of labour obligations and relations, including for taking a decision on employment or for assessing the employee's work skills;

i) the data subject has made his/her data public without stipulating an explicit prohibition of use;

j) the processing of special category data is necessary for the protection of a significant public interest;

k) special category data are processed by a political, professional association, religious or non-religious philosophical belief organisation for the purposes of the same activity. In this case, the processing of the said data may be related only to current or former members of this association/organisation or to persons who have a permanent connection with this association/organisation arising from its purposes, provided that the said data are not transferred to a third person without the consent of the data subject;

l) the processing of special category data is necessary for archiving in the public interest, scientific or historical research or statistical purposes in accordance with law, if the law provides for the implementation of appropriate and specific measures to protect the rights and interests of the data subject. This basis for the processing of special category data shall not apply if a special law directly provides for a restriction of the processing of these data with additional and different conditions;

m) special category data are processed for the purpose of the functioning of the unified analytical system of migration data;

n) special category data are processed for the purpose of exercising the right to education of persons with disabilities and persons with special educational needs;

o) special category data are processed for the purpose of considering the matter provided for by paragraph 2 of Article 11 of the Law of Georgia "On the Elimination of Violence against Women and/or Domestic Violence, Protection of and Assistance to Victims of Violence";

p) special category data are processed for the purpose of the resocialisation and rehabilitation of convicts and former prisoners, as well as coordination of the referral process of minors;

[ p) special category data are processed for the purpose of the resocialisation and rehabilitation of convicts and former prisoners, as well as coordination of the referral process of minors or the process of ensuring the well-being, rehabilitation and support of a minor in conflict with the law; (shall enter into force from 1 May 2026)]

q) special category data are processed for the purpose of issuing or publishing, as public information, a court act adopted as a result of an open court hearing in accordance with the Organic Law of Georgia "On Common Courts";

r) special category data are processed in the cases directly provided for by the Law of Georgia "On Public Procurement";

s) special category data are processed for the functioning of the institutional mechanism of inter-agency coordination — for the purposes of identifying and/or managing a case involving harm or expected risks to the child's life, health or safety and/or to the child's best interests or his/her right, and within these purposes, in order to ensure coordination among the competent bodies (agencies) determined by the Government of Georgia, in the cases provided for by paragraph 3 of Article 83 and paragraph 2¹ of Article 84 of the Code of the Rights of the Child;

t) special category data are processed in the cases directly provided for by the Law of Georgia "On the Structure, Powers and Rules of Activity of the Government of Georgia".

2. In the case of processing of the data provided for by subparagraph "q" of paragraph 1 of this Article, their issuance as public information and publication shall be permissible in accordance with the Organic Law of Georgia "On Common Courts".

3. The obligation to substantiate the legal basis for the processing of special category data shall be borne by the person responsible for the processing.

Law of Georgia of 12 November 2025 No. 1054 – website, 17.11.2025.

Article 7. Rules and conditions for giving consent to the processing of data concerning a minor1. The processing of data concerning a minor on the basis of his/her consent shall be permissible if he/she has reached the age of 16, while the processing of data concerning a minor under 16 — with the consent of his/her parent or other legal representative, except for cases directly provided for by law, including where the consent of a minor between 16 and 18 years of age and of his/her parent or other legal representative is necessary for the processing of data.🔗

2. The person responsible for the processing shall be obliged to take reasonable and adequate measures to confirm the existence of the consent of the parent or other legal representative of a minor under 16.

3. The processing of special category data concerning a minor shall be permissible only on the basis of the written consent of his/her parent or other legal representative, except for cases directly provided for by law.

4. When processing data concerning a minor, the person responsible for the processing shall be obliged to take into account and protect the best interests of the minor.

5. The consent of a minor, his/her parent or other legal representative to the processing of data shall not be considered valid if the processing of data poses a threat to or causes harm to the best interests of the minor.

6. The provisions provided for by this Article shall not apply to relations related to the validity of a transaction as determined by the Civil Code of Georgia.

Article 8. Protection of Data about a Deceased Person 1. After the death of a data subject, the processing of data about him/her shall be permissible:🔗

a) on the grounds defined by Articles 5 and 6 of this Law;

b) if this processing of data is not prohibited by the data subject's parent, child, grandchild or spouse (except where the data subject, before death, prohibited in writing the processing of data about him/her after his/her death);

c) if 30 years have elapsed since the death of the data subject;

d) if it is necessary for the exercise of a right related to inheritance.

2. The processing of the name, surname, sex, dates of birth and death of a deceased person shall be permissible, notwithstanding the existence of the circumstances and grounds provided for by paragraph 1 of this Article.

Article 9. Processing of Biometric Data 1. Biometric data may be processed only where this is necessary for the purposes of the carrying out of activities, security, protection of property and prevention of the disclosure of confidential information, and these purposes cannot be achieved by other means or are associated with disproportionately great effort, as well as for the purposes of the issuance of an identity document in the manner established by law, the identification of a person crossing the state border, combating illegal migration, the granting of international protection, the prevention of crime, the investigation of crime, criminal prosecution, the administration of justice, the enforcement of detention and imprisonment, the enforcement of non-custodial sentences and probation, the resocialisation and rehabilitation of convicts and former prisoners, the coordination of the referral process of minors, operational-search activity, ensuring information security and cybersecurity, or in other cases directly provided for by law.🔗

[1. Biometric data may be processed only where this is necessary for the purposes of the carrying out of activities, security, protection of property and prevention of the disclosure of confidential information, and these purposes cannot be achieved by other means or are associated with disproportionately great effort, as well as for the purposes of the issuance of an identity document in the manner established by law, the identification of a person crossing the state border, combating illegal migration, the granting of international protection, the prevention of crime, the investigation of crime, criminal prosecution, the administration of justice, the enforcement of detention and imprisonment, the enforcement of non-custodial sentences and probation, the resocialisation and rehabilitation of convicts and former prisoners, the coordination of the referral process of minors or of the process of ensuring the well-being, rehabilitation and support of a minor in conflict with the law, operational-search activity, ensuring information security and cybersecurity, or in other cases directly provided for by law. (shall enter into force from 1 May 2026)]

2. The person responsible for processing shall, in accordance with the principles provided for by Article 4 of this Law, before the processing of the data, determine in writing the purpose and scope of the processing of biometric data, the period of storage of these data, the rules and conditions for their storage and destruction, as well as the mechanisms for the protection of the rights of the data subject.

Law of Georgia of 12 November 2025 No. 1054 – website, 17.11.2025.

Article 10. Implementation of Video Monitoring1. Video monitoring shall be permissible for the prevention of crime, its detection, public safety, personal safety and protection of property, protection of a minor (including protection from harmful influence), protection of confidential information, for examination/testing purposes, as well as for the performance of tasks assigned to other public and/or other legitimate interest spheres, if video monitoring is an adequate and proportionate means for the purpose of data processing.🔗

2. In order to carry out video monitoring, the person responsible for processing shall, in accordance with the principles established by Article 4 of this Law, determine in writing the purpose and scope of video monitoring, the duration of video monitoring and the storage period of the video recording, the rules and conditions for access to the video recording, its storage and destruction, and the mechanisms for protecting the rights of the data subject, except when a natural person carries out video monitoring in a residential building.

3. Video monitoring of an employee's work process/space shall be permissible only in exceptional cases, if the achievement of the purposes defined by paragraph 1 of this Article is impossible by other means or is associated with disproportionately great effort.

4. Video monitoring shall be inadmissible in changing rooms, places intended for hygiene, or in a space where the subject has a reasonable expectation of privacy and/or the implementation of video monitoring contradicts generally recognized moral norms.

5. The video monitoring system and video recordings shall be protected from unlawful interference and use. The person responsible for processing shall ensure the recording of each case of access to video recordings, including the recording of the time of access and the user name, which enables the identification of the person carrying out the access.

6. In a residential building, video monitoring of the common entrance of this residential building and the common space existing in the residential building shall be permissible with the written consent of more than half of the owners (in the event of impossibility of determining the owner, the consent of the possessor may be obtained), except when the person responsible for processing/person authorized to process carries out video monitoring for the performance of an obligation imposed on him/her by the legislation of Georgia and the common entrance and common space of the residential building fall within the video monitoring area.

7. Video monitoring of the entrance of individual property located in a residential building shall be permissible only by the decision of its owner/possessor or with his/her written consent, in such a way that the implementation of video monitoring does not infringe the legitimate interests of other persons (including the owner, the lawful user of the area).

8. The person responsible for processing/the person authorized to process shall be obliged to prominently place a warning sign about the conduct of video monitoring, and in the case defined by paragraph 3 of this article — to additionally warn the employee in writing about the specific purpose(s) of video monitoring. In the event of compliance with the requirements provided for by this paragraph, the data subject shall be considered informed about the processing of data concerning him/her.

9. The warning sign about the conduct of video monitoring shall contain the relevant inscription, an easily perceivable image about the conduct of video monitoring, and the name of the person responsible for processing and his/her contact data.

Article 11. Conduct of audio monitoring1. Audio monitoring shall be permissible:🔗

a) with the consent of the data subject;

b) for making a record of proceedings;

c) to protect the significant legitimate interest of the person responsible for processing, if appropriate and specific measures are defined for the protection of the rights and interests of the data subject;

d) in other cases directly provided for by the legislation of Georgia.

2. In order to carry out audio monitoring, the person responsible for processing shall be obliged, in accordance with the principles provided for by Article 4 of this Law, to determine in writing in advance the purpose and scope of audio monitoring, the duration of audio monitoring, the rules and conditions of access to the audio recording, its storage and destruction, and the mechanisms for the protection of the rights of the data subject.

3. The person responsible for processing shall be obliged to warn the data subject in advance or immediately upon the commencement of audio monitoring about the conduct of audio monitoring and to explain to him/her his/her right to refuse (if such exists). The burden of proving the informing of the data subject shall be borne by the person responsible for processing/the person authorized to process.

4. In the case of informing the data subject by a warning sign about audio monitoring, this warning sign shall contain the relevant inscription, an easily perceivable image about the conduct of audio monitoring, and the name of the person responsible for processing and his/her contact data.

Article 12. Data Processing for Direct Marketing Purposes1. Notwithstanding the basis for the collection/acquisition of data and their accessibility, data processing for direct marketing purposes may be carried out only with the consent of the data subject.🔗

2. Except for the name, surname, address, telephone number and email address of the data subject, the written consent of the data subject shall be required for the processing of other data for direct marketing purposes.

3. Before obtaining the consent of the data subject and during the carrying out of direct marketing, the person responsible for processing/the person authorised to process shall clearly explain to the data subject, in simple and comprehensible language, the right to withdraw consent at any time and the mechanism/rule for exercising that right.

4. The person responsible for processing/the person authorised to process shall be obliged to stop the processing of data for direct marketing purposes within a reasonable period after receipt of the relevant request of the data subject, but not later than 7 working days. In order to ensure this obligation, the person responsible for processing/the person authorised to process shall bear the obligation to exchange information on the withdrawal of consent by the data subject.

5. The person responsible for processing/the person authorised to process shall be obliged to ensure that the data subject has the opportunity to request the cessation of data processing for direct marketing purposes in the same form in which the direct marketing is carried out, or to determine another accessible and adequate means for requesting the cessation of data processing.

6. The means provided for by paragraph 5 of this Article for requesting the cessation of data processing for direct marketing purposes shall be simple. At the same time, the data subject shall be given clear and easily comprehensible instructions on the use of that means.

7. It shall be inadmissible to impose a fee or any other restriction for the exercise by the data subject of the right to withdraw consent.

8. When carrying out direct marketing, the burden of proving the existence of the data subject's consent, the simplicity of the means of refusal, the easy comprehensibility of the instructions on its use, its accessibility and adequacy shall lie with the person responsible for processing and/or the person authorised to process.

9. The person responsible for processing/the person authorised to process shall be obliged to record and retain the time and fact of the giving of consent by the data subject to the processing of data concerning him/her and of the withdrawal of consent for the duration of the carrying out of direct marketing and for 1 year from the cessation of the carrying out of direct marketing.

Article 13. Right to receive information about data processing1. A data subject shall have the right to request from the person responsible for processing confirmation as to whether data concerning him/her are being processed, whether the data processing is justified, and, in accordance with the request, to receive free of charge the following information:🔗

a) on the data concerning him/her that are being processed, as well as on the basis and purpose of the processing of such data;

b) on the source of the collection/obtaining of the data;

c) on the period (time) of storage of the data, and, where it is impossible to determine a specific period, on the criteria for determining the period;

d) on the rights of the data subject provided for by this Chapter;

e) on the legal basis and purposes of the transfer of the data, as well as on the appropriate data protection safeguards, where the data are transferred to another State or an international organisation;

f) on the identity of the data recipient or the categories of data recipients, including information on the basis and purpose of the transfer of the data, where the data are transferred to a third party;

g) on a decision taken as a result of automated processing, including profiling, and on the logic used to take such a decision, as well as on its impact on the data processing and the expected/likely outcome of the processing.

2. A data subject shall have the right to receive the information provided for by paragraph 1 of this Article no later than 10 working days from his/her request. In special cases and with due justification, this period may be extended by no more than 10 working days, of which the data subject shall be notified immediately.

3. The person responsible for processing shall be entitled, as necessary, to provide the data subject with any information in order to ensure the transparency of data processing in accordance with subparagraph „a“ of paragraph 1 of Article 4 of this Law, except where the provision of the information is contrary to law.

4. Unless otherwise provided by the legislation of Georgia, a data subject shall have the right to choose himself/herself the form in which the information provided for by paragraph 1 of this Article is to be provided. At the same time, if the data subject does not request the provision of the information in another form, the information shall be provided to him/her in the same form in which the information was requested.

Article 14. Right to access data and receive copies 1. A data subject shall have the right to access, from the controller, personal data existing about him/her and to receive copies of these data free of charge, except in cases where for access to data and/or issuance of data copies:🔗

a) a fee is provided for by the legislation of Georgia;

b) a reasonable fee has been established by the controller for issuing them in a form different from the form in which the data are stored, due to the resources spent and/or the frequency of requests.

2. The data subject shall have the right to access the data provided for by paragraph 1 of this article and/or receive copies thereof no later than 10 working days from the request, except in the case where another time limit is established by the legislation of Georgia.

3. The time limit provided for by paragraph 2 of this article may, in special cases and with proper justification, be extended by no more than 10 working days, of which the data subject shall be notified immediately.

4. The data subject shall have the right to access the data provided for by paragraph 1 of this article and/or receive copies thereof in the form in which they are stored by the controller and/or processor. The data subject shall also have the right to request the provision of copies of data about him/her in a different form, in exchange for a reasonable fee established by the controller and if this is technically possible.

5. The fee determined by the controller under subparagraph “b” of paragraph 1 of this article shall not exceed the amount of resources actually spent. The burden of establishing the fee and proving the reasonableness of its amount shall be borne by the controller.

Article 15. Right to rectification, updating and completion of data1. A data subject shall have the right to request the person responsible for processing to rectify, update and/or complete false, inaccurate and/or incomplete data concerning him/her.🔗

2. No later than 10 working days after the submission by the data subject of the request provided for by paragraph 1 of this Article (unless otherwise provided by Georgian legislation), the data shall be rectified, updated and/or completed, or the data subject shall be notified of the grounds for refusal of the request and the procedure for appealing the refusal shall be explained to him/her.

3. If the person responsible for processing independently of the data subject discovers that the data at its disposal are false, inaccurate and/or incomplete, it shall, within a reasonable time, rectify, update and/or complete the data and, within 10 working days from the rectification of the data, notify the data subject thereof.

4. The person responsible for processing shall not have the obligation to notify the data subject provided for by paragraph 3 of this Article if the rectification, updating and/or completion of the data relates to the correction/elimination of a technical error.

5. If there is an objective circumstance that makes it impossible to fulfil the obligation to inform the data subject within the period established by paragraph 3 of this Article, the person responsible for processing shall provide the data subject with information about the change immediately upon the first communication with him/her.

6. The person responsible for processing shall be obliged to notify all data recipients, as well as all other persons responsible for processing and persons authorized to process of the same data to whom it has itself transferred the data, of the updating and completion of the data, except when the provision of such information is impossible due to the multitude of persons responsible for processing/persons authorized to process or data recipients and/or disproportionately large costs.

7. The persons provided for by paragraph 6 of this Article shall, after receiving the relevant information, be obliged to rectify, update and/or complete the data within a reasonable time.

Article 16. Right to stop, erasure or destruction of data processing 1. The data subject shall have the right to request from the person responsible for processing the stop, erasure or destruction of data processing concerning him/her (including profiling).🔗

2. No later than 10 working days from the request provided for by paragraph 1 of this Article (unless otherwise provided by the legislation of Georgia), data processing shall be stopped and/or the data shall be erased or destroyed, or the data subject shall be notified of the ground for refusal of the request and the procedure for appealing the refusal shall be explained to him/her.

3. The person responsible for processing shall have the right to refuse to satisfy the request provided for by paragraph 1 of this Article if:

a) any of the grounds for data processing provided for by Article 5 or Article 6 of this Law exists;

b) the data are processed for the purpose of substantiating a legal claim or defence;

c) data processing is necessary for exercising the right to freedom of expression or information;

d) the data are processed for archiving purposes in the public interest provided for by law, for scientific or historical research or for statistical purposes, and the exercise of the right to stop, erasure or destruction of data processing will make impossible or significantly impair the achievement of the processing purposes.

4. If any of the grounds provided for by paragraph 3 of this Article exists, the person responsible for processing shall bear the obligation to substantiate the relevant ground.

5. The data subject shall have the right to receive information about the stop, erasure or destruction of data processing immediately upon the performance of the relevant action, without delay, but no later than 10 working days.

6. In the case of processing of data concerning him/her in a publicly accessible form, the data subject shall have the right to additionally request from the person responsible for processing the restriction of access to the data and/or the erasure of copies of the data or any internet link connecting to the data.

7. The person responsible for processing shall be obliged to notify all recipients of the data, as well as all other persons responsible for processing and persons authorised to process the same data to whom he/she has transferred the data, about the stop, erasure or destruction of data processing, except in the case where the provision of such information is impossible due to the multiplicity of persons responsible for processing/persons authorised to process or recipients of the data and/or disproportionately large expenses.

8. The persons provided for by paragraphs 6 and 7 of this Article shall, after receiving the relevant information, be obliged to stop data processing and to erase or destroy the data.

Article 17. Right to Block Data1. The data subject shall have the right to request the person responsible for processing to block the data if one of the following circumstances exists:🔗

a) The data subject contests the authenticity or accuracy of the data;

b) The processing of the data is unlawful, however the data subject objects to their deletion and requests the blocking of the data;

c) The data are no longer necessary for achieving the purpose of their processing, however the data subject needs them for filing a complaint/claim;

d) The data subject requests the termination of the processing of the data, deletion or destruction, and the consideration of this request is ongoing;

e) There is a necessity to store the data for the purpose of using them as evidence.

2. The person responsible for processing shall be obliged, upon the request of the data subject, to block the data when one of the circumstances provided for by paragraph 1 of this Article exists, except when the blocking of the data may pose a threat to:

a) the performance of the duties imposed on the person responsible for processing by law and/or by a subordinate normative act issued under the law and on its basis;

b) the performance of tasks assigned to the sphere of public interest in accordance with law or the exercise of powers conferred on the person responsible for processing by the legislation of Georgia;

c) the legitimate interests of the person responsible for processing or of a third party, except when there is an overriding interest in the protection of the rights of the data subject, especially of a minor;

d) the protection of interests provided for by paragraph 6 of Article 50 of this Law.

3. After making a decision on the blocking of data, the person responsible for processing is entitled to make a decision on the unblocking of the data if any of the grounds provided for by subparagraphs “a”−“d” of paragraph 2 of this Article exists.

4. The data shall be blocked for the duration of the existence of the reason for their blocking, and during this period, if technically possible, the decision on the blocking of the data must be attached to the relevant data.

5. The data subject shall have the right to receive information on the decision made regarding the blocking of data or on the decision regarding the grounds for refusal to block data, immediately upon its adoption, immediately, but not later than 3 working days from the request.

6. In the case of blocking of data in accordance with paragraph 1 of this Article, the data, except for their storage, may be processed otherwise in the following cases:

a) with the consent of the data subject;

b) to substantiate a legal claim or defense;

c) to protect the interests of the person responsible for processing or of a third party;

d) in accordance with law, to protect public interest.

Article 18. Right to data portability In the case of automated processing of data on the grounds provided for by subparagraphs "a" and "b" of paragraph 1 of Article 5 and subparagraph "a" of paragraph 1 of Article 6 of this Law, where this is technically possible, the data subject shall have the right to receive from the person responsible for processing, in a structured, commonly used and machine-readable format, the data provided by him/her, or to request the transfer of such data to another person responsible for processing.🔗

Article 19. Automated individual decision-making and related rights 1. The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or other similarly significant effects for him/her, except where decision-making based on profiling:🔗

a) is based on the explicit consent of the data subject;

b) is necessary for entering into, or performing, a contract between the data subject and the person responsible for processing;

c) is provided for by law or by a subordinate normative act issued within the scope of authority delegated on the basis of law.

2. At the relevant request of the data subject, the person responsible for processing shall take appropriate measures to protect the rights, freedoms and legitimate interests of the data subject, including by involving human resources in the decision-making process as defined by paragraph 1 of this Article (except for the case provided for by subparagraph "c" of paragraph 1 of this Article), by giving the data subject the opportunity to express his/her opinion and to contest the decision.

3. When making a decision as defined by paragraph 1 of this Article, the use of special category data shall be permissible only in the cases provided for by subparagraphs "a", "f" and "j" of paragraph 1 of Article 6 of this Law, where appropriate guarantees for the protection of the rights, freedoms and legitimate interests of the data subject exist.

Article 20. Right to withdraw consent 1. The data subject shall have the right to withdraw at any time, without any explanation or justification, the consent given by him/her. In this case, in accordance with the request of the data subject, the processing of data shall be stopped and/or the processed data shall be deleted or destroyed no later than 10 working days from the request, unless another ground for data processing exists.🔗

2. The data subject shall have the right to withdraw consent in the same form in which the consent was given.

3. Before withdrawing consent, the data subject shall have the right to request and receive from the person responsible for processing information on the possible consequences of withdrawing consent.

Article 21. Restriction of Data Subject's Rights 1. The rights of the data subject provided for by Articles 13–20, 24 and 25 of this Law may be restricted if this is directly provided for by Georgian legislation, this does not violate fundamental human rights and freedoms, this is a necessary and proportionate measure in a democratic society, and the exercise of these rights may endanger:🔗

a) interests of state security, information security and cyber security and/or defence;

b) interests of public security;

c) prevention of crime, investigation of crime, criminal prosecution, administration of justice, execution of detention and imprisonment, execution of non-custodial sentences and probation, operative-investigative activity;

d) interests important for the country related to financial or economic (including monetary, budgetary and tax), public health and social protection issues;

e) detection of a violation by the data subject of professional ethics norms, including those of a regulated profession, and imposition of liability on him/her;

f) exercise of the functions and powers of regulatory and/or supervisory bodies in the areas defined by subparagraphs „a“, „b“, „c“, „d“, „e“, „g“ or „i“ of paragraph 1 of this Article;

g) rights and freedoms of the data subject and/or other persons, including freedom of expression;

h) protection of state, commercial, professional and other types of secrets provided for by law;

i) substantiation of a legal claim or defence.

2. A measure provided for by paragraph 1 of this Article may be applied only to the extent necessary to achieve the purpose of the restriction.

3. If the grounds provided for by paragraph 1 of this Article exist, the decision of the person responsible for processing on the restriction of the data subject's right and refusal to exercise it shall be communicated to the data subject, except where the provision of information would endanger the achievement of the purpose(s) provided for by paragraph 1 of this Article.

4. The exercise of the rights of the data subject provided for by Articles 13–20, 24 and 25 of this Law shall be ensured free of charge, except for the exceptions established by this same Law. In the event of submission by the data subject of a request with unreasonable frequency, the person responsible for processing is entitled to refuse to fulfil it, and shall immediately notify the data subject thereof in writing and explain the right to appeal.

5. In the event of restriction of the data subject's right and refusal of his/her request, the burden of proof shall be borne by the person responsible for processing.

Article 22. Right to appeal 1. In the event of a violation of the rights and established rules provided for by this Law, the data subject shall have the right to apply, in the manner established by law, to the State Audit Office, a court and/or a superior administrative body.🔗

2. The data subject shall have the right to demand that the State Audit Office adopt a decision on the blocking of data before issuing a decision on the completion of the consideration of the application.

3. The data subject shall have the right to appeal the decision of the State Audit Office in court, in compliance with the conditions and terms provided for by the legislation of Georgia.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 23. Obligation to protect the rights of the data subject 1. In accordance with the request of the data subject, the person responsible for processing shall be obliged to ensure, in the established manner, the exercise of the rights of the data subject defined by Chapter III of this Law, including to take all measures for compliance with the requirements of this Law and, where necessary, for their demonstration.🔗

2. The obligations provided for by paragraph 1 of this article shall also extend to the person authorized to process in relation to the information protected/existing with that person.

Article 24. Informing the data subject in the case of collection of data directly from him 1. When collecting data directly from the data subject, the person responsible for processing shall, before the collection of data or immediately upon the commencement of collection, provide the data subject with at least the following information:🔗

a) the identity/name and contact information of the person responsible for processing, his representative and/or the person authorised to process (if any);

b) the purposes and legal basis of the data processing;

c) whether the provision of data is mandatory, and if the provision of data is mandatory − the legal consequences of refusal to provide data, as well as information that the collection/obtaining of data is provided for by the legislation of Georgia or is a necessary condition for concluding a contract (if such information exists);

d) the significant legitimate interests of the person responsible for processing or of a third party, if the data are processed in accordance with subparagraph „i“ of paragraph 1 of Article 5 of this Law;

e) the identity and contact information of the personal data protection officer (if any);

f) the identity of the data recipient or the categories of data recipients (if any);

g) the planned transfer of data and the existence of appropriate data protection safeguards, including authorisation for the transfer of data (if any), if the person responsible for processing plans to transfer data to another state or to an international organisation;

h) the period of data storage, and if it is impossible to determine a specific period, the criteria for determining the period;

i) the rights of the data subject provided for by Chapter III of this Law.

2. The provision of the information provided for by paragraph 1 of this Article is not mandatory if there is a reasonable assumption that the data subject already possesses this information.

3. The rule established by paragraph 1 of this Article shall not apply if special legislation establishes a different rule for informing the data subject when collecting data from him and this rule does not result in a violation of the fundamental rights and freedoms of the data subject. In this case, if there is a written request of the subject, the person responsible for processing shall provide the data subject with the information provided for by paragraph 1 of this Article within 10 working days from the request, unless there are grounds for restriction of the right provided for by Article 21 of this Law.

4. The time limit for providing the information provided for by paragraph 3 of this Article may, in exceptional cases and with due justification, be extended by no more than 10 working days, of which the data subject shall be notified immediately.

5. The person responsible for processing shall provide the data subject with the information provided for by paragraph 1 of this Article in a simple and comprehensible language for him/her, in particular where the data subject is a minor. This information may be provided orally or in writing (including electronically), except where the data subject requests to receive the information in writing.

Article 25. Informing the data subject where the data are not collected directly from him/her1. If the data are not collected directly from the data subject, the person responsible for processing shall provide the data subject with the information provided for by subparagraphs „a“−„i“ of paragraph 1 of Article 24 of this Law, and shall also inform him/her which data concerning him/her are being processed and the source of obtaining these data, including whether the data were obtained from a publicly available source.🔗

2. The information provided for by paragraph 1 of this Article shall be provided by the person responsible for processing to the data subject within a reasonable time, or, if the data are used for communication with the data subject, at the time of the first communication with him/her, and if disclosure of the data is planned, − before the disclosure of the data, but not later than 10 working days after the obtaining of the data, unless there are grounds for restriction of the right provided for by Article 21 of this Law.

3. The obligation to provide the information provided for by this Article shall not apply to the person responsible for processing and/or the person authorised to process, if:

a) the data subject already possesses the information provided for by paragraph 1 of this Article;

b) the collection or disclosure of the data is provided for by law or is necessary for the performance of a duty imposed by the legislation of Georgia;

c) the provision of the information is impossible or requires disproportionately great effort, or the performance of the obligation provided for by this Article will cause significant harm or will make it impossible to fulfil the lawful purpose(s) of the data processing. In these cases, the person responsible for processing shall take appropriate measures to protect the rights and legitimate interests of the data subject, including by making publicly/universally available general information about the obtaining of the data.

Article 26. Priority of data minimisation as the initial method automatically applied before choosing an alternative approach when creating a new product or service 1. Taking into account new technologies, implementation costs, the nature, scope, context and purposes of processing, as well as the risks expected for the rights and freedoms of the data subject and the principles of data processing, the controller, both when determining the means of processing and directly in the processing process, shall take appropriate technical and organisational measures (including pseudonymisation and/or others). The taking of these measures shall ensure the effective implementation of the principles of data processing and the integration of protection mechanisms in the data processing process in order to protect the rights of the data subject.🔗

2. When determining the amount of data, the scale of data processing, storage periods and access to data, the controller shall ensure that such technical and organisational measures are taken that only the volume of data necessary for the specific purpose of processing is processed automatically. These measures shall be applied in such a way that, before choosing a permitted alternative approach, only access to the minimum volume of data is automatically ensured for an indefinite circle of persons.

Article 27. Data Security 1. The controller shall take appropriate technical and organizational measures to ensure the processing of data in accordance with this Law and be able to demonstrate compliance of data processing with this Law.🔗

2. The controller and the processor shall take organizational and technical measures appropriate to the possible and associated risks of data processing (including data pseudonymization, logging of access to data, information security mechanisms (confidentiality, integrity, availability) and others) that ensure the protection of data from loss, unlawful processing, including destruction, deletion, alteration, disclosure or use.

3. When determining the organizational and technical measures necessary to ensure data security, the controller and the processor shall take into account the categories and volume of data, the purpose, form and means of data processing, and the possible risks of violation of the rights of the data subject, and shall also periodically assess the effectiveness of the technical and organizational measures taken to ensure data security and, where necessary, ensure the adoption of adequate measures to protect data security and/or the updating of existing ones.

4. The controller and the processor shall ensure the logging of all actions performed in relation to data existing in electronic form (including information on incidents, collection, alteration, access to, disclosure (transfer), linking and deletion of data). When processing data existing in non-electronic form, the controller and the processor shall ensure the logging of all actions related to the disclosure and/or alteration of data (including information on incidents).

5. Any employee of the controller and the processor who participates in data processing or who has access to data shall not exceed the scope of the powers granted to him/her, shall observe the secrecy and confidentiality of data, including after the termination of his/her official powers.

6. The controller and the processor shall, in accordance with the powers of employees, determine the scope of their access to data and take adequate measures to prevent, detect and suppress facts of unlawful processing of data by employees, including ensuring that employees are informed about data security protection issues.

Article 28. Recording of information related to data processing and notification to the State Audit Office1. The controller and its special representative (if any) shall ensure, in writing or electronically, the recording of the following information related to data processing:🔗

a) the identity/name and contact information of the controller, the special representative, the personal data protection officer, the joint controllers, and the processor;

b) on the purposes of data processing;

c) on data subjects and categories of data;

d) on the categories of recipients of data (including recipients of data located in another state or an international organisation);

e) on the transfer of data to another state or an international organisation, as well as on appropriate data protection safeguards, including on the authorisation of the State Audit Office (if any);

f) on data storage periods, and if it is impossible to determine a specific period, on the criteria for determining their storage period;

g) a general description of the organisational and technical measures taken for data security;

h) information on incidents (if any).

2. Each processor and a person engaged by it in data processing in accordance with the procedure established by paragraph 7 of Article 36 of this Law shall ensure, in writing or electronically, the recording of the following information related to data processing:

a) the identity/name and contact information of the processor, the personal data protection officer, the controller, the joint controllers, and the special representative;

b) on the types of data processing carried out for the controller or on its behalf;

c) the information provided for by subparagraph „e“ of paragraph 1 of this Article, if it participates in the process of transferring data to another state or an international organisation;

d) a general description of the organisational and technical measures taken to ensure data security;

e) information on incidents (if any).

3. The controller, the joint controllers, the processor and the special representative shall provide the information provided for by paragraphs 1 and 2 of this Article to the State Audit Office upon the relevant request, immediately, but no later than 3 working days.

4. One copy of the judge's ruling on the granting of permission to conduct a covert investigative action requested by a law enforcement agency or on refusal to grant permission to conduct it, which contains only the requisites and the operative part, as well as one copy of the judge's ruling on recognising a covert investigative action conducted by a law enforcement agency without court permission as lawful/unlawful, which contains only the requisites and the operative part, shall be submitted to the State Audit Office in the manner established by the Criminal Procedure Code of Georgia.

5. An electronic communications company shall, within 24 hours of the transfer of such data, notify the State Audit Office of the transfer to a law enforcement agency of electronic communication identification data in the manner established by Article 136 of the Criminal Procedure Code of Georgia.

6. In a case of urgent necessity, a prosecutor's resolution on the conduct of a covert investigative action, which contains only the requisites and the operative part, shall be submitted in material (documentary) form to the State Audit Office by the prosecutor or, on the prosecutor's assignment, by an investigator, no later than 12 hours from the start time indicated in that resolution on the covert investigative action.

7. The Agency shall, upon receipt, provide to the State Audit Office through the electronic control system the electronic copy of the judge's ruling on the granting of permission to conduct the covert investigative action provided for by subparagraph „a“ of paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia, which contains only the requisites and the operative part, as well as the electronic copy of the prosecutor's resolution on the conduct of that covert investigative action, which contains only the requisites and the operative part.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 29. Obligation to notify the State Audit Office about an incident 1. The person responsible for processing shall be obliged to record the incident, the resulting consequence, the measures taken and, no later than 72 hours after detection of the incident, notify the State Audit Office about it in writing or electronically, except where it is unlikely that the incident will cause significant damage and/or pose a significant threat to fundamental human rights and freedoms.🔗

2. The person authorized to process shall be obliged to immediately notify the person responsible for processing about the incident.

3. The notification provided for by paragraph 1 of this article shall contain the following information:

a) about the circumstances, nature and time of the incident;

b) about the approximate categories and amount of data unlawfully disclosed, damaged, deleted, destroyed, obtained, lost, altered as a result of the incident, as well as the approximate categories and number of data subjects who were placed at risk as a result of the incident;

c) about the approximate damage caused by the incident, and the measures taken or planned by the person responsible for processing for the purpose of mitigating or eliminating it;

d) about whether the person responsible for processing plans to notify the data subject (data subjects) about the incident in the manner established by Article 30 of this Law and within what time period;

e) the contact details of the personal data protection officer or another contact person.

4. If it is impossible to provide the information provided for by paragraph 3 of this article at once and in full, the person responsible for processing shall have the right, in agreement with the State Audit Office, to provide the information in stages within a reasonable time.

5. If, according to the notification submitted to the State Audit Office, the person responsible for processing does not ensure or cannot ensure the informing of the data subject (data subjects) about the incident, taking into account the circumstances of the incident, the approximate damage and/or the number of data subjects, the State Audit Office shall be entitled to make public the information at its disposal about the incident, except where one of the circumstances provided for by paragraph 3 of Article 30 of this Law exists.

6. The rule established by paragraph 5 of this article shall not apply if the notification provided for by paragraph 1 of this article is accompanied by an indication by the public or private institution responsible for data processing that the public disclosure of information about the incident will pose a threat to:

a) the interests of state security, information security and cyber security and/or defence;

b) the interests of public security;

c) the prevention of crime, the investigation of crime, criminal prosecution, the administration of justice, the execution of detention and imprisonment, the execution of non-custodial sentences and probation, and operative-investigative activity;

d) interests related to financial or economic (including monetary, budgetary and tax), public health and social protection matters important for the country.

7. The State Audit Office is entitled, in the cases provided for by paragraph 6 of this Article, not to make information public also when the notification is not accompanied by any of the indications provided for by subparagraphs "a"–"d" of paragraph 6 of this Article.

8. The person responsible for processing, in respect of the relevant circumstance provided for by the corresponding subparagraph defined by paragraph 6 of this Article, shall indicate to the State Audit Office in the incident notification in accordance with the procedure established by paragraph 9 of this Article.

9. The criteria for defining an incident provided for by paragraph 1 of this Article that poses a significant threat to fundamental human rights and freedoms, and the procedure for notifying the State Audit Office of such an incident, shall be established by a normative act of the Auditor General.

10. The public institution responsible for processing data in respect of the proper circumstance defined by the corresponding subparagraph provided for by paragraph 6 of this Article shall indicate in accordance with its own competence/field of activity.

11. The basis of information security and cyber security provided for by subparagraph "a" of paragraph 6 of this Article shall be indicated by the subject of the critical information system, taking into account its category, in agreement with the relevant competent agency in the field of information security and cyber security.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 30. Obligation to inform the data subject about an incident1. If an incident is highly likely to cause significant damage and/or poses a significant threat to fundamental human rights and freedoms, the person responsible for processing shall, at the first opportunity after discovering the incident, without unjustified delay, notify the data subject about the incident and, in simple and comprehensible language for them, provide the following information:🔗

a) a general description of the incident and the circumstances related thereto;

b) information about the presumed/resulting damage caused by the incident, and about the measures taken or planned to mitigate or eliminate it;

c) contact details of the personal data protection officer or another person.

2. If informing the data subject requires disproportionately large costs or efforts, the person responsible for processing shall make the information provided for by paragraph 1 of this article public or disseminate it in another form that duly ensures the possibility for the data subject to receive the information.

3. The obligation provided for by paragraphs 1 and 2 of this article shall not arise where one of the following circumstances exists:

a) informing the data subject about the incident poses a threat to the interests of the protection of state secrets, the interests of state security, information security and cybersecurity and/or defence, the interests of public security, the prevention of crime, operative-investigative activity, the investigation of crime, criminal prosecution, the administration of justice, the enforcement of detention and imprisonment, the enforcement of non-custodial sentences and probation, and the interests of the country relating to significant financial or economic (including monetary, budgetary and tax), public health and social protection matters;

b) the person responsible for processing has taken appropriate security measures, as a result of which a significant threat of violation of fundamental human rights and freedoms was avoided.

4. The criteria for determining an incident provided for by paragraph 1 of this article that poses a significant threat to fundamental human rights and freedoms, and the procedure for notifying the State Audit Office of the said incident, shall be established by a normative act of the Auditor General.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 31. Data Protection Impact Assessment1. If, during data processing, taking into account new technologies, the category of data, the volume, the purposes and means of data processing, a threat of infringement of fundamental human rights and freedoms is created with a high probability, the person responsible for processing shall carry out a data protection impact assessment in advance.🔗

2. In addition to the case provided for by paragraph 1, the carrying out of a data protection impact assessment is mandatory if the person responsible for processing:

a) takes a decision having legal, financial or other materially significant consequences for the data subject fully automatically, including on the basis of profiling;

b) processes special category data of a large number of data subjects;

c) carries out systematic and large-scale monitoring of the behaviour of data subjects in public gathering places.

3. When carrying out a data protection impact assessment, the person responsible for processing shall create a written document containing:

a) a description of the category of data, the purposes of their processing, proportionality, the process and the grounds;

b) an assessment of the possible threats of infringement of fundamental human rights and freedoms and a description of the organisational-technical measures provided for the purpose of ensuring data security.

4. In the event of a material change in the data processing process, the person responsible for processing shall update the data protection impact assessment document. The person responsible for processing shall keep the data protection impact assessment document for the entire period of data processing, and in the event of termination of data processing − for a period of not less than 1 year.

5. If, as a result of the data protection impact assessment, a high threat of infringement of fundamental human rights and freedoms is identified, the person responsible for processing shall take all necessary measures to substantially reduce the threats and, where necessary, apply to the State Audit Office for consultation. If it is impossible to substantially reduce the threat of infringement of fundamental human rights and freedoms by additional organisational-technical measures, the data shall not be processed.

6. In the event of applying to the State Audit Office on the basis of paragraph 5 of this Article, the person responsible for processing shall submit:

a) information on the authority of the person responsible for processing, the persons jointly responsible for processing and the person authorised to process;

b) information on the purposes and means of the planned data processing;

c) information on the security measures defined for the protection of the rights and freedoms of the data subject;

d) the contact information of the personal data protection officer (if any);

e) the data protection impact assessment;

f) other (additional) information in the event of a request by the State Audit Office.

7. At least 3 percent of the population of Georgia shall be considered a large number of data subjects, which is calculated according to the latest results of the population census.

8. The data protection impact document defined by paragraph 3 of this article shall not be subject to public disclosure if this may create a threat to the interests of state security, information security and cybersecurity and/or defence, the interests of public security, the prevention of crime, operative-investigative activity, the investigation of crime, criminal prosecution, the administration of justice, the execution of detention and imprisonment, the execution of non-custodial sentences and probation, the interests important for the country related to financial or economic (including monetary, budgetary and tax), public health and social protection issues, or the overriding legitimate interests of the person responsible for processing or the person authorised to process.

9. The criteria for determining the circumstances giving rise to the obligation to assess the impact on data protection provided for by paragraph 1 of this article and the procedure for conducting the assessment shall be established by a normative act of the Auditor General.

Law of Georgia No. 1289 of 17 December 2025 – website, 23 December 2025.

Article 32. Obligations of the controller in cases of obtaining consent from the data subject and withdrawal of consent by the data subject 1. If the controller plans to obtain the written consent of the data subject by a document that also concerns other issues, the controller shall formulate the text on consent in this document in clear, simple and understandable language and separate it from other parts of the document.🔗

2. If the data subject's consent is given within the framework of a contract or service, when determining the voluntariness of consent, along with other circumstances, it shall be assessed whether this consent is a necessary condition of the contract or service and whether the relevant service can be received/the contract can be concluded without this consent.

3. Before obtaining consent from the data subject, the controller shall ensure that the data subject is informed of his/her right to withdraw consent.

4. In the event of withdrawal of consent by the data subject, the controller shall immediately stop processing the data and delete or destroy the processed data, unless otherwise provided by this law.

5. The obligation defined by paragraph 4 of this article shall not apply to the case provided for by paragraph 3 of Article 16 of this law.

6. Withdrawal of consent by the data subject shall not entail the annulment of legal consequences arising before the withdrawal of consent and within the scope of the consent.

7. On the basis of a request of the data subject or in the event that this produces a legal, financial or other materially significant consequence for the data subject, the controller shall, before the withdrawal of consent by the data subject, provide him/her with information about the consequences of withdrawal of consent.

8. The controller shall ensure a free, simple and accessible mechanism for withdrawal of consent, including ensuring the possibility of withdrawal of consent in the same form in which the consent was given.

9. In the event of a dispute concerning the existence of the data subject's consent to data processing, the burden of proving the existence of the fact of the data subject's consent shall be borne by the controller.

Article 33. Personal Data Protection Officer 1. A public institution, an insurance organization, a commercial bank, a microfinance organization, a credit bureau, an electronic communications company, an airline, an airport, a medical institution, as well as a data controller/data processor that processes the data of a large number of data subjects or carries out systematic and large-scale monitoring of their behaviour, shall be obliged to designate or determine a Personal Data Protection Officer. The Personal Data Protection Officer shall ensure:🔗

a) informing the data controller, the data processor and their employees on issues related to data protection, including on the adoption or amendment of regulatory legal norms, and providing them with consultation and methodological assistance;

b) participation in the development of internal regulations related to data processing and of the data protection impact assessment document, as well as monitoring of the compliance by the data controller or the data processor with Georgian legislation and internal organizational documents;

c) analysis of applications and complaints received in connection with data processing and issuing of appropriate recommendations;

d) receiving consultations from the State Audit Office, representation of the data controller and the data processor in relations with the State Audit Office, submission of information and documents at its request, and coordination and monitoring of the fulfilment of its assignments and recommendations;

e) in the event of an application by a data subject, providing him/her with information about the data processing processes and his/her rights;

f) performance of other functions by the data controller or the data processor for the purpose of raising data processing standards.

2. In addition to the cases provided for by paragraph 1 of this Article, other data controllers shall have the right, at their own discretion, to designate or determine a Personal Data Protection Officer.

3. The function of the Personal Data Protection Officer may be performed by an employee of the data controller or the data processor or by another person (persons) on the basis of a service contract. The Personal Data Protection Officer shall have the right to perform other functions as well, if this does not give rise to a conflict of interests.

4. Persons responsible for processing or persons authorized to process may appoint or designate a common personal data protection officer, taking into account that the personal data protection officer will be ensured the full performance of his/her functions. If the person responsible for processing or the person authorized to process is a public institution, it is also permissible to appoint or designate a common personal data protection officer for several state institutions, taking into account the organizational structure and size of these institutions.

5. A personal data protection officer shall have appropriate knowledge in the field of data protection.

6. A personal data protection officer shall, taking into account the specific situation, be accountable to the management structure at the highest possible level.

7. The person responsible for processing and the person authorized to process shall ensure the appropriate involvement of the personal data protection officer in the process of taking a decision important in relation to data processing, shall provide him/her with appropriate resources, and shall also ensure his/her independence in the performance of his/her activities.

8. The person responsible for processing and the person authorized to process are obliged, within 10 working days from the appointment or designation of the personal data protection officer, as well as from his/her replacement, to notify the State Audit Office of his/her identity and contact information, which publishes this information. The person responsible for processing and the person authorized to process are obliged to proactively publish the identity and contact information of the personal data protection officer on the website (if any) or by other accessible means.

9. The person responsible for processing and the person authorized to process, in the event of the temporary absence of the personal data protection officer or the termination of his/her powers, are obliged, without unjustified delay, to vest another person with the powers of the personal data protection officer.

10. The circle of persons responsible for processing and persons authorized to process who do not have the obligation to appoint or designate a personal data protection officer shall be determined by a normative act of the Auditor General. When determining the circle of these persons, the Auditor General shall take into account the criteria established by the first paragraph of this Article.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 34. Special representative🔗

1. In the case of data processing by a person responsible for processing/person authorized to process registered outside the borders of Georgia using technical means existing in Georgia, the person responsible for processing/person authorized to process shall be obliged, before processing data using technical means existing in Georgia, to appoint or designate a special representative in Georgia. The special representative shall be registered in accordance with the procedure established by a normative act issued by the State Audit Office.

2. In the case provided for by paragraph 1 of this Article, the person responsible for processing shall acquire the right to process data only after registration of the special representative.

3. The special representative shall be obliged to comply with a request and/or decision made in respect of him/her by the Auditor General in accordance with the procedure established by law.

4. The data subject shall have the right to request, through the special representative, the exercise of his/her right vis-à-vis the person responsible for processing/person authorized to process registered outside the borders of Georgia.

5. The appointment of a special representative does not release the person responsible for processing/person authorized to process registered outside the borders of Georgia from the obligation to respond to a request and/or decision made in respect of him/her by the Auditor General in accordance with the procedure established by law.

6. The obligation provided for by paragraph 1 of this Article shall not apply to a person responsible for processing/person authorized to process that is established in the Member States of the European Union, and to which the personal data protection rules in force in the European Union apply.

7. The obligation provided for by paragraph 1 of this Article shall not apply to a person responsible for processing/person authorized to process that is established in a state with an adequate level of data protection recognized by the European Union.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 35. Persons responsible for joint processing 1. If persons responsible for joint processing are involved in data processing, they shall determine in advance in writing, in connection with the fulfillment of the requirements of this Law, the obligations and responsibilities of each of them, including with respect to the protection of the rights of the data subject and the obligations provided for by Articles 13–20, 24 and 25 of this Law.🔗

2. If joint data processing is provided for by the legislation of Georgia, the obligations and responsibilities of each person responsible for joint processing shall be determined by the relevant legal act and/or written agreement.

3. Information on the distribution of obligations and responsibilities among persons responsible for joint processing shall be accessible to the data subject. The data subject's right to apply individually to each person responsible for joint processing shall not be restricted.

Article 36. Person Authorized to Process 1. A person authorized to process may process data only on the basis of a legal act or a written agreement concluded with the person responsible for processing, which shall determine the grounds and purposes of data processing, the categories of data to be processed, the period of data processing, and the rights and obligations of the person responsible for processing and the person authorized to process.🔗

2. The written agreement provided for by paragraph 1 of this article shall also contain the following obligations of the person authorized to process:

a) to process data only in accordance with the written assignment or instruction of the person responsible for processing;

b) to ensure that the natural person directly involved in data processing has an obligation to maintain confidentiality;

c) to ensure data security in accordance with this Law;

d) to delete or transfer to the person responsible for processing the data in the event of cancellation or termination of the agreement provided for by paragraph 1 of this article, and also to delete their copies, unless the obligation to store them is established by the legislation of Georgia;

e) in order to ensure compliance with the obligations established by this Law, to provide the person responsible for processing with appropriate information and to facilitate the exercise of monitoring of data processing by that person.

3. The legal act provided for by paragraph 1 of this article or the written agreement concluded with the person responsible for processing may, for the purpose of ensuring data security and protection of the rights of the data subject, provide for the obligation of the person authorized to process to provide assistance to the person responsible for processing.

4. Further processing of data by the person authorized to process for a purpose different from the purposes determined by the agreement or the legal act shall be inadmissible.

5. Data processing through a person authorized to process shall be permissible only if the person authorized to process ensures the adoption of appropriate organizational and technical measures to protect the rights of the data subject and the requirements of the law. It shall be inadmissible to conclude an agreement on data processing if, based on the activities and/or purposes of the person authorized to process, there is a high risk of non-purposeful processing of data or of infringement of the rights of the data subject.

6. The person responsible for processing shall be obliged to require in advance from the person authorized to process information on data processing in accordance with the law and to monitor the processing of data by the person authorized to process.

7. Unless otherwise provided by the legislation of Georgia, it shall be inadmissible for the processor to transfer its rights and obligations in full or in part to another person without the prior written consent of the controller. The consent of the controller shall not release the processor from the corresponding obligations and liability.

8. Unless otherwise provided by the legislation of Georgia, in the event of a dispute related to data processing arising between the processor and the controller, the processor shall be obliged to immediately stop the data processing and fully transfer the data in its possession to the controller.

9. In the event of revocation or termination of the legal act (or the corresponding norm) or written agreement provided for by paragraph 1 of this Article, data processing shall be stopped and the processed data shall be immediately and fully transferred to the controller.

10. The processor shall be obliged to take appropriate organizational and technical measures to assist the controller in fulfilling its obligations related to the exercise of the data subject's rights.

Article 37. Transfer of Data to Another State and an International Organisation 1. Transfer of data to another state and an international organisation shall be permissible if the requirements for data processing provided for by this Law exist and adequate guarantees for the protection of data and the protection of the rights of the data subject are ensured in the respective state or international organisation.🔗

2. In addition to paragraph 1 of this Article, transfer of data to another state and an international organisation shall be permissible if:

a) the transfer of data is provided for by an international treaty and agreement of Georgia;

b) the person responsible for processing ensures adequate guarantees for the protection of data by a contract concluded between the person responsible for processing and the respective state, an appropriate public institution of such state, a legal entity or a natural person, or an international organisation;

c) the transfer of data is provided for by the Criminal Procedure Code of Georgia (for the purpose of carrying out an investigative action), the Law of Georgia “On the Legal Status of Aliens and Stateless Persons”, the Law of Georgia “On International Cooperation in the Criminal Law Sphere”, the Law of Georgia “On International Cooperation in the Law Enforcement Sphere”, a normative act adopted on the basis of the Organic Law of Georgia “On the National Bank of Georgia” or the Law of Georgia “On Facilitating the Prevention of Money Laundering and the Financing of Terrorism”;

d) after receiving information about the absence of adequate guarantees for the protection of data in the respective state and about possible threats, the data subject gives written consent;

e) the transfer of data is necessary for the protection of the vital interests of the data subject and the data subject is physically or legally unable to give consent to the processing of data;

f) there is a significant public interest in accordance with law (including the prevention, investigation and detection of crime and criminal prosecution, the execution of sentence and the carrying out of operative-investigative measures) and the transfer of data is a necessary and proportionate measure in a democratic society.

3. On the basis of subparagraph “b” of paragraph 2 of this Article, the transfer of data may be carried out only after obtaining the permission of the State Audit Office, the procedure for the issuance of which shall be established by a normative act of the Auditor General.

4. In the case of transfer of data on any of the grounds provided for by paragraph 2 of this Article, the person responsible for processing/person authorised to process shall be obliged to take the organisational and technical measures necessary for the secure transfer of data.

5. In the case of transfer of data on the basis of subparagraph “b” of paragraph 2 of this Article, the agreement on the transfer of data shall provide for enforceable conditions having binding legal force.

6. The further transfer of data transferred to another state and an international organisation to a third party shall be permissible only if the further transfer of data serves the original purposes and satisfies the grounds provided for by this Article for the transfer of data and the adequate data protection guarantees.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 38. Establishment of adequate data protection guarantees 1. The existence of adequate data protection guarantees in another state and/or an international organisation shall be assessed by the State Audit Office on the basis of an analysis of the international obligations assumed in relation to data protection and of the regulatory legislation, of the guarantees for the protection of the rights and freedoms of the data subject (including effective legal remedy mechanisms), of the rules for the further international transfer of data, and of the existence, powers and activity of an independent supervisory body for data protection.🔗

2. The list of states and international organisations in which adequate data protection guarantees are ensured shall be determined by a normative act of the Auditor General.

3. The list determined by a normative act of the State Audit Office shall be reviewed at least once every 3 years. If a state and/or an international organisation no longer satisfies the conditions provided for by paragraph 1 of this Article, the corresponding amendments shall be made to the list determined by the said normative act, and they shall have no retroactive force.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 39. Principles of the activity of the State Audit Office in the field of data protection 1. When carrying out its activity in the field of data protection, the State Audit Office shall be guided by the Constitution of Georgia, the international treaties of Georgia, the universally recognised principles and norms of international law, this Law and other relevant legal acts.🔗

2. The principles of the activity of the State Audit Office in the field of data protection are:

a) legality;

b) protection of human rights and freedoms;

c) independence and political neutrality;

d) objectivity and impartiality;

e) professionalism;

f) protection of secrecy and confidentiality.

3. The procedure for submitting the report of the State Audit Office on the activity carried out in the field of data protection to the Parliament of Georgia shall be determined by this Law and the Rules of Procedure of the Parliament of Georgia.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 40. Power of the Auditor General to issue an act in the field of data protection 1. Within the scope of his/her powers, the Auditor General shall issue a subordinate normative act — an order — on a matter related to the activities of the State Audit Office in the field of data protection.🔗

2. Within the scope of his/her powers in the field of data protection, the Auditor General shall, on the basis of and in order to implement the relevant normative act, issue (adopt) individual legal acts, including an order, a directive, a decision.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 41. (removed) Law of Georgia of 29 May 2024 No. 4210 – website, 12.06.2024.🔗

Law of Georgia of 2 April 2025 No. 416 – website, 03.04.2025.

Law of Georgia of 13 May 2025 No. 543 – website, 14.05.2025.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 42. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 43. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 44. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 45. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 46. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 47. (removed) Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 48. Report of the State Audit Office on the activities carried out in the field of data protection 1. The Auditor General shall submit to the Parliament of Georgia, once a year, not later than 1 June, a report on the state of data protection in Georgia, on the conduct of covert investigative actions and on the control of the activity carried out in the central bank of identifying data of electronic communication.🔗

2. The report of the State Audit Office shall contain information on the activities carried out by the State Audit Office in the field of data protection during the year, general assessments, conclusions and recommendations related to the state of data protection in Georgia, information on significant violations detected during the year and on the measures taken, and general statistical information on the activities carried out in the field of control over the conduct of covert investigative actions.

3. The Auditor General shall submit to the Parliament of Georgia, once a year, a report on the results of the control over the conduct of the investigative actions provided for by Articles 136–138 of the Criminal Procedure Code of Georgia and of the covert investigative actions provided for by subparagraphs „a“ and „b“ of the first paragraph of Article 143¹ of the same Code. The Bureau of the Parliament of Georgia shall transmit the said report to the relevant committee of the Parliament of Georgia and to the Trust Group.

4. Information on the activities carried out by the State Audit Office, taking into account the restrictions established by this Article, shall be provided to the public through the website of the State Audit Office.

5. The State Audit Office is entitled, on its own initiative, at any time, to publish a special report on the matters which relate to its activities and which it considers significant.

Law of Georgia No. 4210 of 29 May 2024 – website, 12.06.2024.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 49. Main directions of the activity of the State Audit Office in the field of data protection The State Audit Office shall exercise control over the lawfulness of data processing in Georgia. The main directions of the activity of the State Audit Office in this field are:🔗

a) provision of consultations on matters related to data protection;

b) consideration of applications related to data protection;

c) verification (inspection) of the lawfulness of data processing;

d) provision of information to the public on the state of data protection in Georgia and on significant events related thereto and raising its awareness.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 50. Consideration by the State Audit Office of a data subject's application 1. The State Audit Office shall be obliged to consider a data subject's application related to data processing and to apply the measures provided for by the legislation of Georgia.🔗

2. Within 10 days from receipt of the data subject's application, the State Audit Office shall adopt a decision on the measures to be applied, of which it shall notify the applicant.

3. The State Audit Office shall be entitled to conduct an inspection for the purpose of studying and examining the circumstances related to the data subject's application. Any person responsible for processing and/or person authorized to process shall be obliged, upon request of the State Audit Office, to transfer to it the relevant material, information and/or document.

4. The time limit for consideration by the State Audit Office of a data subject's application shall not exceed 2 months. By a reasoned decision of the State Audit Office, the time limit for consideration of the data subject's application may be extended by no more than 1 month.

5. The State Audit Office shall be entitled, during consideration of the data subject's application, to suspend the relevant proceedings on the ground of requesting additional material, information and/or documentation, of which it shall notify the data subject. Consideration of the data subject's application shall resume immediately upon elimination of this ground. The period of suspension of the said proceedings shall not be counted in the time limit provided for by paragraph 4 of this Article.

6. The State Audit Office shall be entitled, before completion of consideration of the data subject's application, to adopt a decision on blocking of data. Notwithstanding the blocking of data, the processing of this data may continue if this is necessary to protect the vital interests of the data subject or a third party, as well as for the purposes of state security and defence.

7. After consideration of the data subject's application, the State Audit Office shall adopt a decision on the application of one of the measures provided for by Article 52 of this Law, of which, in the manner and within the time limit established by the legislation of Georgia, it shall notify the data subject and the person responsible for processing and/or the person authorized to process.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 51. Conducting an Inspection by the State Audit Office 1. The State Audit Office is entitled, on its own initiative or on the basis of an application by an interested person, to conduct an inspection of any person responsible for processing and/or person authorized to process. The decision on conducting the inspection provided for by this Article shall be made by the Auditor General.🔗

2. Conducting an inspection by the State Audit Office implies:

a) determining the observance of data processing principles and the existence of lawful grounds for data processing;

b) verification of the compliance of organizational and technical measures and procedures implemented for the protection of data security with the requirements established by the legislation of Georgia;

c) verification of the lawfulness of the transfer of data to another state and an international organization;

d) verification of the observance of the rules and requirements established by this Law and other normative acts for the protection of data.

3. The State Audit Office is entitled, when conducting an inspection, to request from any institution, natural person and/or legal entity a document and/or information, including information containing state, tax, banking, commercial, professional secrets and/or data, as well as materials and/or documentation and/or information reflecting operational-search activities and crime investigation, which constitute a state secret and are necessary for conducting the inspection within the scope established by paragraph 2 of this Article.

4. The person responsible for processing and/or the person authorized to process shall be obliged to provide the State Audit Office with any material, information and/or document immediately, but not later than 10 working days, if responding to the information request requires:

a) retrieval and processing of information in another institution or structural unit, or consultation with that institution or unit;

b) retrieval and processing of a significant volume of information/documents.

5. The State Audit Office is entitled, on the basis of a reasoned request by the person responsible for processing and/or the person authorized to process, to extend the time limit provided for by paragraph 4 of this Article by not more than 10 working days.

6. The State Audit Office is entitled, for the purpose of conducting an inspection, to enter any institution and organization and to review any document and information, including information containing state, tax, banking, commercial, professional secrets and/or data, as well as materials and/or documentation and/or information reflecting operational-search activities and crime investigation, which constitute a state secret, regardless of their content and form of storage.

7. Taking into account the results of the inspection, the State Audit Office is entitled to apply the measures provided for by Article 52 of this Law.

8. The relevant employee of the State Audit Office shall protect the security of information containing secrets of any kind and shall not disclose secret information that became known to him/her in the course of performing his/her official duties. This obligation shall remain with the relevant employee of the State Audit Office even after the termination of his/her powers.

Law of Georgia No. 1289 of 17 December 2025 – website, 23 December 2025.

Article 52. Application of measures by the State Audit Office 1. If the State Audit Office detects a violation of this Law or of another normative act regulating data processing, it is entitled to apply one of the following measures or several of them simultaneously:🔗

a) request the correction of the violation and of the deficiencies related to data processing in the form and within the time limit specified by it;

b) request the temporary or permanent termination of data processing, if the measures and procedures implemented by the person responsible for processing or the person authorized to process for the protection of data security do not comply with the requirements established by the legislation of Georgia;

c) request the termination of data processing, the blocking, deletion, destruction or depersonalization of data, if it considers that data processing is carried out in violation of the legislation of Georgia;

d) request the termination of the transfer of data to another state and an international organization, if the transfer of data is carried out in violation of the legislation of Georgia;

e) provide written advice and give recommendations to the person responsible for processing and/or the person authorized to process in the event of an insignificant violation by it of the rules related to data processing;

f) impose administrative liability on the offender.

2. The person responsible for processing and/or the person authorized to process shall, within the time limit specified by the State Audit Office, comply with its requests and notify it of their compliance.

3. If the person responsible for processing and/or the person authorized to process fails to comply with the requests of the State Audit Office, the State Audit Office is entitled to apply to a court, a law enforcement body and/or the supervisory (regulatory) state institution defined by the legislation of Georgia for the relevant field.

4. If the State Audit Office detects an administrative offence related to data processing, it is entitled to draw up a protocol of administrative offence and, accordingly, impose administrative liability on the person responsible for processing and/or the person authorized to process in accordance with the procedure established by this Law and the Code of Administrative Offences of Georgia.

5. If the State Audit Office, in the course of its activities, considers that there are signs of a crime, it shall, in accordance with the procedure established by law, notify the authorized state body thereof.

6. The execution of a decision of the State Audit Office in the field of data protection is mandatory and it may be appealed only to a court in accordance with the procedure established by law.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 53. Provision of consultation and implementation of educational activities by the State Audit Office 1. The State Audit Office shall, where a corresponding request exists, provide consultation to state authorities, municipal bodies, other public institutions, legal entities of private law and natural persons on any issue related to data processing and protection.🔗

2. The State Audit Office carries out educational activities on issues related to data processing and protection.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 54. Control over the conduct of covert investigative actions and over activity carried out in the Central Bank of Electronic Communication Identifying Data 1. During the conduct of the covert investigative action provided for by subparagraph „a“ of paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia – covert wiretapping and recording of telephone communication – the State Audit Office shall control:🔗

a) by the electronic control system − the lawfulness of data processing;

b) by the special electronic control system − the lawfulness of data processing;

c) the lawfulness of data processing by the person responsible for processing/person authorised to process (inspection).

2. The State Audit Office shall exercise supervision over the conduct of the investigative actions provided for by Articles 136–138 of the Criminal Procedure Code of Georgia by comparing the information provided by the court, the prosecution and the electronic communication service provider and by verifying (inspecting) the lawfulness of data processing by the person responsible for processing/person authorised to process.

3. The State Audit Office shall exercise supervision over the conduct of the covert investigative actions provided for by subparagraphs „b“, „d“ and „f“ of paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia by verifying (inspecting) the lawfulness of data processing by the person responsible for processing/person authorised to process.

4. The State Audit Office shall exercise supervision over the conduct of the covert investigative action provided for by subparagraph „e“ of paragraph 1 of Article 143¹ of the Criminal Procedure Code of Georgia by verifying (inspecting) the lawfulness of data processing by the person responsible for processing/person authorised to process, in accordance with the procedure established by this Law. In the case provided for by this paragraph, when carrying out the verification (inspection), the requesting of information about the identity of a person participating in the conduct of the covert investigative action (except for the data subject, the investigator and the prosecutor) and his/her participation in the process of carrying out the verification (inspection), as well as the requesting of information about the characteristics of the operational and operational-technical equipment used during the conduct of the covert investigative action provided for by this paragraph, shall be possible only with the consent of the head of the body conducting the covert investigative action. In the case provided for by this paragraph, the carrying out of the verification (inspection) does not include direct participation in the process of preparation/conduct of the covert investigative action and on-site inspection of a disguised residential or official or other disguised facility and building.

5. The State Audit Office shall control the conduct of the covert investigative action provided for by subparagraph „c“ of the first paragraph of Article 143¹ of the Criminal Procedure Code of Georgia, as well as the implementation of the measure provided for by subparagraph „b“ of paragraph 3 of Article 7 of the Law of Georgia on Operative-Investigative Activity, through the special electronic system for controlling real-time geolocation determination and by verifying (inspecting) the lawfulness of data processing by the person responsible for processing/person authorised to process.

6. The State Audit Office shall control the activity carried out in the Central Bank of Electronic Communication Identifying Data through the electronic system for controlling the Central Bank of Electronic Communication Identifying Data and by verifying (inspecting) the lawfulness of data processing by the person responsible for processing/person authorised to process.

7. When conducting an inspection of the Agency, the State Audit Office shall be entitled to:

a) enter the restricted access area of the Agency and observe in real time the performance of activities by the authorised bodies;

b) review the legal documents and technical instructions regulating the Agency's activities (including those containing state secrets);

c) receive information on the technical infrastructure used for the purposes of covert investigative actions and inspect this infrastructure;

d) require explanations from the Agency's employees regarding individual issues identified during the inspection;

e) exercise other powers provided for by this Law.

8. An employee of the Agency shall be obliged to cooperate with the State Audit Office − provide the State Audit Office in full with the requested information and documents, as well as give explanations regarding individual issues identified during the inspection.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 55. Legal protection of the relevant employee of the State Audit Office 1. An employee of the State Audit Office participating in the control of the lawfulness of data processing is a representative of state authority while performing official duties and is protected by the state. Compliance with the lawful demand of this employee of the State Audit Office is mandatory for everyone.🔗

2. No one has the right to interfere in the official activity of the employee of the State Audit Office defined by paragraph 1 of this article, except in cases provided by law.

3. Obstruction of the employee of the State Audit Office defined by paragraph 1 of this article while performing official duties, infringement of his honour and dignity, resistance to him, threat or violence against him, or infringement of his life, health or property entails the liability established by the legislation of Georgia. In the event of receiving information about infringement of the life, health and property of the employee of the State Audit Office defined by paragraph 1 of this article or of his family member, state bodies shall be obliged to carry out the measures provided by law to protect his/their personal and property safety.

4. The employee of the State Audit Office defined by paragraph 1 of this article shall refuse to execute a clearly unlawful order or instruction, if he knew or should have known about its unlawfulness, and shall act within the framework of the law.

5. The employee of the State Audit Office defined by paragraph 1 of this article shall, in the event of receiving a clearly unlawful order or instruction, notify the Auditor General thereof.

6. The employee of the State Audit Office defined by paragraph 1 of this article who refuses to execute a clearly unlawful order or instruction shall not be held liable.

7. The person giving a clearly unlawful order or instruction to the employee of the State Audit Office defined by paragraph 1 of this article shall be held liable in the manner established by law.

8. The employee of the State Audit Office defined by paragraph 1 of this article has the right to apply to court to protect his rights and freedoms.

9. The employee of the State Audit Office defined by paragraph 1 of this article, in order to confirm his official authority, is issued an identity card and/or a special badge, the form and issuance procedure of which are established by the Auditor General.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 56. Social protection of the relevant employee of the State Audit Office 1. The State shall ensure the social protection of the employee of the State Audit Office defined by paragraph 1 of Article 55 of this Law.🔗

2. Unless otherwise provided by the legislation of Georgia, the guarantees of social protection of a civil servant provided for by the Law of Georgia “On Public Service” shall apply to the employee of the State Audit Office defined by paragraph 1 of Article 55 of this Law (including the guarantees of social protection related to bodily injury or death in connection with the performance of official duties).

3. The procedure for and amount of remuneration of the employee of the State Audit Office defined by paragraph 1 of Article 55 of this Law shall be determined by normative acts of the Auditor General and other legislative and subordinate normative acts of Georgia.

4. The employee of the State Audit Office defined by paragraph 1 of Article 55 of this Law shall be subject to compulsory State insurance. The issues related to the State insurance of the family members of this employee of the State Audit Office (including the circle of family members) shall be determined by the Auditor General.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 57. (Deleted)Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.🔗

Article 58. General provisions on proceedings by the State Audit Office 1. The detection of an administrative offence related to data processing provided for by Articles 66–87 of this Law (hereinafter – an administrative offence) and the imposition of the corresponding administrative liability shall be carried out by the State Audit Office on the basis of an inspection (audit) and/or consideration of an application of a data subject (hereinafter – proceedings). The State Audit Office shall draw up a protocol on an administrative offence and impose an administrative penalty on the offender in accordance with the procedure established by the legislation of Georgia.🔗

2. By a decision of the Auditor General, both the joining of several proceedings into one case and the separation of a case from one proceeding for separate proceedings shall be permissible.

3. In the field of data protection, the powers of the Auditor General and the procedure for proceedings shall be determined by this Law, the Code of Administrative Offences of Georgia, other legislative acts of Georgia and normative acts of the Auditor General.

4. In the relationship between the norms of the Code of Administrative Offences of Georgia and the norms of this Law, preference shall be given to the norms of this Law.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 59. Evidence 1. For the purposes of case proceedings, evidence is any factual data on the basis of which, in accordance with the procedure established by the legislation of Georgia, the Auditor General and/or an authorized person of the State Audit Office establishes the existence or non-existence of an administrative offence, the guilt of a person in committing it, and other circumstances relevant to the correct resolution of the case.🔗

2. For the purposes of this Article, the following may be considered evidence: information and a document obtained within the framework of the consideration of a data subject's application and/or as a result of an inspection; explanations of the data subject, the person responsible for processing, the persons jointly responsible for processing, the person authorized to process, the special representative and a witness; the admission of the offender; the minutes (record) of the oral hearing; the expert's conclusion; materials of the ascertainment of facts; an audio recording; a video recording; a photo; information and a document obtained from public sources; a document prepared/issued/certified by an authorized person or body; the minutes of an administrative offence drawn up by the Auditor General or an authorized person of the State Audit Office, the form and procedure for familiarization with which are established by the Auditor General; the minutes of the inspection of the lawfulness of data processing; material evidence; any other information, document or material relevant to establishing the objective circumstances of the case.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 60. Circumstances to be clarified in case proceedings and imposition of an administrative penalty 1. When considering a case of an administrative offence and imposing an administrative penalty, the State Audit Office or the court establishes: whether an administrative offence was committed, whether the person is guilty of committing it, whether he/she is subject to administrative liability, whether there exist circumstances mitigating and aggravating administrative liability. It also establishes other circumstances relevant to the correct resolution of the said case.🔗

2. In the presence of a circumstance mitigating administrative liability, the State Audit Office or the court is entitled to give the offender a warning if the administrative offence is insignificant.

3. An administrative penalty shall be imposed on the offender for committing an administrative offence within the limits established by this Law, in accordance with the article which provides for administrative liability.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 61. Circumstances mitigating liability for an administrative offence1. The following shall be considered circumstances mitigating administrative liability for an administrative offence:🔗

a) cessation of the unlawful act and remedying of the damage caused as a result of the administrative offence and/or taking appropriate organisational-technical measures for the purpose of preventing a similar offence in the future;

b) commission of an administrative offence by a minor;

c) sincere repentance for the administrative offence and cooperation with the State Audit Office;

d) other circumstances, such as the nature of the administrative offence and the degree of guilt of the offender, which the Auditor General considers to be mitigating circumstances when deciding a case of an administrative offence.

2. The obligation to submit evidence confirming the existence of the circumstances mitigating administrative liability provided for by paragraph 1 of this Article shall be borne by the person responsible for processing/the person authorised to process.

3. Where a mitigating circumstance provided for by subparagraph "a" and/or "b" of paragraph 1 of this Article exists, the amount of the fine provided for by Articles 66–87 of this Law shall be reduced by 30 per cent.

4. Where a mitigating circumstance provided for by subparagraph "c" and/or "d" of paragraph 1 of this Article exists, the amount of the fine provided for by Articles 66–87 of this Law shall be reduced by 20 per cent.

5. Where the grounds for reduction of the amount of the fine provided for by paragraphs 3 and 4 of this Article exist simultaneously, the amount of the fine provided for by Articles 66–87 of this Law shall be reduced by 50 per cent.

Law of Georgia of 17 December 2025 No. 1289 – website, 23 December 2025.

Article 62. Circumstances aggravating liability for an administrative offenceThe following shall be considered circumstances aggravating administrative liability for the administrative offences provided for by this Law:🔗

a) repeated commission within 1 year of the same administrative offence, for which an administrative penalty has already been imposed on the person responsible for processing/the person authorised to process/a third party;

b) processing of the data of a large number of data subjects in violation of the requirements of this Law or creating such a threat;

c) processing of a minor's data in violation of the requirements of this Law;

d) commission of an administrative offence for gain;

e) commission of an administrative offence with a discriminatory motive.

Article 63. Right to appeal a decision of the Auditor General adopted as a result of proceedings 1. A decision of the Auditor General adopted as a result of proceedings may be appealed to a court, in accordance with the procedure established by the Code of Administrative Offences of Georgia, by the person against whom this decision has been issued, within 1 month from its official notification.🔗

2. In the event of an appeal to a court of a decision of the Auditor General adopted as a result of proceedings, it shall be enforced from the moment the judgment adopted by the court enters into legal force.

Law of Georgia of 17 December 2025 No. 1289 – website, 23 December 2025.

Article 64. Imposition of an administrative penalty for the commission of several administrative offences1. In the case of a multiplicity of administrative offences committed by one and the same person, the total amount of fines imposed on him/her shall not exceed the amounts provided for by paragraph 2 of this Article, if one of the following conditions exists:🔗

a) administrative offences are detected within the framework of a single inspection;

b) the issue of imposing administrative liability for several administrative offences is considered within the framework of a single proceeding;

c) administrative liability is imposed for an administrative offence that was committed before the imposition of an administrative penalty already applied to the same person, in which case both the amount of administrative liability imposed and the amount of administrative liability to be imposed shall be taken into account.

2. In the case provided for by paragraph 1 of this Article, the total amount of fines imposed on a person shall not exceed:

a) GEL 10,000 in the case of a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as in the case of a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) GEL 20,000 in the case of a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. If one and the same act may be considered as several administrative offences provided for by the relevant articles of this Law, the measure of administrative liability shall be applied only for the administrative offence and to the extent for which the most severe liability is provided for by this Law.

4. For the purposes of paragraph 3 of this Article, an offence shall also be considered a single act if there is a combination of several acts closely and directly connected to each other, which in essence constitutes a single administrative offence.

5. If, in the commission of an administrative offence provided for by this Law, the guilt of only one person responsible for complicity is established, the administrative penalty shall be imposed only on that person, while if the guilt of several persons responsible for complicity is established simultaneously, the administrative penalty shall be imposed jointly and severally on the offending persons responsible for complicity.

6. In the commission of an administrative offence provided for by this Law, along with the administrative penalty, other measures provided for by Article 52 of this Law may also be applied.

7. The Auditor General shall be entitled, for the purposes of imposing the administrative liability provided for by this Law, to request and receive from a legal entity of public law – the Revenue Service information on the annual turnover of a legal entity, a branch of a foreign enterprise and/or an individual entrepreneur, and also to have access to the relevant electronic database of the legal entity of public law – the Revenue Service.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 65. Time limits for imposing an administrative penalty1. For the commission of an administrative offence defined by this Law, a person may be held liable not later than 4 months from the day of commission of the offence, and if the offence is continuing – not later than 4 months from the day of its detection.🔗

2. In the event of termination of criminal prosecution or investigation, but where the actions of the offender contain elements of an administrative offence, an administrative penalty may be imposed on him not later than 2 months from the day of adoption of the decision on termination of criminal prosecution or investigation.

3. In the event of appeal to court of a decision adopted on an administrative offence, the running of the time limit for imposing the administrative penalty provided for by paragraph 1 of this article shall be suspended until the court delivers a final judgment in this case.

Article 66. Violation of data processing principles1. Violation of any principle of data processing provided for by this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 imposed on a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 imposed on a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. Violation of two or more principles of data processing provided for by this Law −

shall result in:

a) a warning or a fine in the amount of GEL 2,000 imposed on a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 imposed on a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 1,500 imposed on a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 3,000 imposed on a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

4. An act provided for by paragraph 2 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3,000 imposed on a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 4,000 imposed on a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 67. Processing of data without the grounds provided for by this Law1. Processing of data without the grounds provided for by this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 4,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 68. Processing of special category data without the grounds provided for by this Law1. Processing of special category data without the grounds provided for by this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 69. Violation of the rules for conducting video monitoring or audio monitoring1. Violation of the rules of video monitoring established by Article 10 of this Law (except for the cases provided for by paragraphs 2 and 4 of this Article) or of audio monitoring provided for by Article 11 of the same Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. Conducting video monitoring in changing rooms, in places designated for hygiene or in other such space where the subject has a reasonable expectation of privacy and/or the surveillance contradicts generally recognized moral norms −

shall result in:

a) a warning or a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 4,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

4. The act provided for by paragraph 2 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 70. Violation of the rules for processing data about a deceased person1. Processing of data about a deceased person in violation of the rules established by Article 8 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 4,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 71. Processing of data for the purposes of direct marketing in violation of the rules1. Processing of data for the purposes of direct marketing in violation of the rules established by this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 4,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 6,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 72. Violation of the rights of a data subject provided for by Chapter III of this Law1. Violation of any right of a data subject provided for by Chapter III of this Law (except Article 22) −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 1,500 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. Violation of two or more rights of a data subject provided for by Chapter III of this Law (except Article 22) −

shall result in:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 1,500 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 3,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

4. An act provided for by paragraph 2 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 73. Failure to fulfil the obligations provided for by paragraphs 2 and 4 of Article 21 of this Law 1. Failure to fulfil the obligation provided for by paragraph 2 of Article 21 of this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 1,500 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. Failure to fulfil the obligation provided for by paragraph 4 of Article 21 of this Law −

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 1,500 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. An act provided for by paragraph 1 or 2 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 74. Failure to fulfil the obligation to inform the data subject1. Failure to fulfil the obligation to inform the data subject provided for by Articles 24 and 25 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 1,500 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 75. Violation of the requirement of the priority of greater data protection as the initial method automatically applied before choosing an alternative approach when creating a new product or service1. Failure to fulfil any of the obligations provided for by Article 26 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 76. Failure to fulfil the obligation to protect data security1. Failure to fulfil the obligation to protect data security provided for by Article 27 of this Law, as established by the same Law, −🔗

shall result in:

a) a warning or a fine in the amount of GEL 2 000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500 000;

b) a warning or a fine in the amount of GEL 4 000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500 000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3 000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500 000;

b) a fine in the amount of GEL 5 000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500 000.

Article 77. Failure to fulfil the obligation to record information related to data processing1. Failure to fulfil the obligation to record information related to data processing provided for by Article 28 of this Law, as established by the same Law, −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1 000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500 000;

b) a warning or a fine in the amount of GEL 1 500 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500 000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 2 000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500 000;

b) a fine in the amount of GEL 3 000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500 000.

Article 78. Failure to fulfil the obligation to notify the State Audit Office about an incident 1. Failure to fulfil the obligation to notify the State Audit Office about an incident provided for by Article 29 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 79. Failure to fulfil the obligation to inform the data subject about an incident 1. Failure to fulfil the obligation to notify the data subject about an incident provided for by Article 30 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 5,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 10,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 80. Failure to comply with the obligation of data protection impact assessment1. Failure to comply with the obligation of data protection impact assessment provided for by Article 31 of this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 3,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 81. Failure to comply with the obligation established by law when obtaining consent from a data subject and when consent is withdrawn by the data subject1. Failure to comply with the obligation established by this same Law when obtaining consent from a data subject and when consent is withdrawn by the data subject, as provided for by Article 32 of this Law −🔗

shall result in:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 4,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 82. Failure to fulfil the obligation related to the appointment of a personal data protection officer1. Failure to fulfil the obligation related to the appointment of a personal data protection officer provided for by paragraph 1 of Article 33 of this Law −🔗

shall result in a warning to the offender.

2. Failure, by the data processor/authorised person provided for by paragraph 1 of Article 33 of this Law, to fulfil the obligation related to the appointment of a personal data protection officer, within 1 year of the imposition of an administrative penalty by the Auditor General −

shall result in a fine of GEL 3,000 imposed on the offender.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 83. Failure to fulfil the obligation related to the determination/appointment of a special representative1. Failure, by the person responsible for processing, to fulfil the obligation related to the determination/appointment of a special representative provided for by paragraph 1 of Article 34 of this Law −🔗

shall result in a warning to the offender or a fine of GEL 3,000.

2. Failure to fulfil the obligation related to the determination/appointment of a special representative provided for by paragraph 1 of Article 34 of this Law, within 1 year of the imposition of an administrative penalty by the Auditor General −

shall result in a fine of GEL 5,000 imposed on the offender.

Law of Georgia No. 1289 of 17 December 2025 – website, 23.12.2025.

Article 84. Failure to fulfil the obligations provided for by Articles 35 and 36 of this Law1. Failure, by the person responsible for processing/the person authorised to process, to fulfil the obligations provided for by Articles 35 and 36 of this Law −🔗

shall result in:

a) a warning to, or a fine of GEL 1,000 imposed on, a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning to, or a fine of GEL 2,000 imposed on, a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. An act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall result in:

a) a fine of GEL 2,000 imposed on a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine of GEL 4,000 imposed on a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 85. Violation of the rules established by Article 37 of this Law1. Transfer of data to another state and/or an international organization in violation of the rules established by Article 37 of this Law −🔗

shall entail:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 4,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The act provided for by paragraph 1 of this Article, committed in the presence of an aggravating circumstance (circumstances), −

shall entail:

a) a fine in the amount of GEL 4,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 6,000 for a legal entity (except for a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign country's enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Article 86. Obstruction of the General Auditor or an authorized person of the State Audit Office in the exercise of the right defined by this Law🔗

1. Violation of the procedure for submitting the information and/or document provided for by paragraph 3 of Article 51 of this Law to the General Auditor or an authorized person of the State Audit Office, or provision of false information −

shall entail:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

2. The same act committed by a person to whom an administrative penalty was imposed within 1 year for the offence provided for by paragraph 1 of this Article −

shall entail:

a) a fine in the amount of GEL 3,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 5,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

3. Any form of obstruction of the State Audit Office or an authorized person of the State Audit Office in the exercise of the right defined by paragraph 6 of Article 51 of this Law −

shall entail:

a) a warning or a fine in the amount of GEL 2,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 4,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

4. The same act committed by a person to whom an administrative penalty was imposed within 1 year for the offence provided for by paragraph 3 of this Article −

shall entail:

a) a fine in the amount of GEL 4,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a fine in the amount of GEL 6,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 87. Failure to comply with a lawful request of the State Audit Office — failure to comply with a lawful request of the State Audit Office (in accordance with subparagraphs „a“−„d“ of paragraph 1 of Article 52 of this Law) —🔗

shall entail:

a) a warning or a fine in the amount of GEL 1,000 for a natural person, a public institution, a non-entrepreneurial (non-commercial) legal entity, as well as a legal entity, a branch of a foreign enterprise and an individual entrepreneur whose annual turnover does not exceed GEL 500,000;

b) a warning or a fine in the amount of GEL 2,000 for a legal entity (except a non-entrepreneurial (non-commercial) legal entity), a branch of a foreign enterprise and an individual entrepreneur whose annual turnover exceeds GEL 500,000.

Law of Georgia of 17 December 2025 No. 1289 – website, 23.12.2025.

Article 88. Transitional Provisions 1. For the commission of an administrative offence related to personal data processing before 1 March 2024, the offender shall bear administrative liability in accordance with the Law of Georgia of 28 December 2011 on Personal Data Protection.🔗

2. A person responsible for processing/a person authorised to process shall be released from the obligation provided for by paragraph 9 of Article 10 and paragraph 4 of Article 11 of this Law in relation to those warning notices which he/she placed before 1 March 2024.

3. A person responsible for processing shall be released from the performance of the obligation provided for by Article 26 of this Law in relation to the software which is used for data processing and was created before 1 March 2024, except where, after 1 March 2024, this software was significantly updated and the performance of the obligation provided for by the same Article does not require the person responsible for processing to incur unjustified expenses.

4. The Head of the Personal Data Protection Service issued the following normative acts before 1 March 2024:

a) criteria for determining an incident posing a significant threat to fundamental human rights and freedoms, and the procedure for notifying the Personal Data Protection Service of an incident. This normative act is issued in agreement with the relevant state agencies;

b) on the criteria for establishing the circumstances giving rise to the obligation to carry out a data protection impact assessment and the procedure for the assessment;

c) on determining the circle of persons who are not obliged to determine/appoint a personal data protection officer;

d) the procedure for registration of a special representative by the Personal Data Protection Service.

Article 89. Normative Act Declared Invalid — The Law of Georgia of 28 December 2011 on Personal Data Protection shall be declared invalid (Legislative Herald of Georgia (www.matsne.gov.ge), 16.01.2012, registration code: 010100000.05.001.016606).🔗

Article 90. Entry of the Law into Force1. This Law, except Articles 1–87 of this Law, paragraphs 2 and 3 of Article 88 and Article 89, shall enter into force upon publication.🔗

2. Articles 1–5 of this Law, subparagraphs „a“–„q“ of paragraph 1 of Article 6, paragraphs 2 and 3, Articles 7–30, 32, 34–79, 81 and 83–87, paragraphs 2 and 3 of Article 88 and Article 89 shall enter into force from 1 March 2024.

3. Articles 31, 33, 80 and 82 of this Law shall enter into force from 1 June 2024.

4. Subparagraph „s“ of paragraph 1 of Article 6 of this Law shall enter into force from 1 January 2025.

5. Subparagraph „r“ of paragraph 1 of Article 6 of this Law shall enter into force from 1 January 2027.

6. The operation of subparagraph „s“ of paragraph 1 of Article 6 of this Law shall be suspended until 1 January 2027.

Law of Georgia of 5 September 2024 No. 4406 – website, 23.09.2024.

Law of Georgia of 6 February 2025 No. 260 – website, 06.02.2025.

President of Georgia Salome Zourabichvili

Tbilisi,

14 June 2023

N3144-XIms-Xmp