Processes personal data, in Georgia
Law on Patient Rights, confidentiality of patient informationsince 1 line
Law of Georgia on Patient Rights, Law No. 283 of , Arts. 27-28 · Read the law's page
- If your service is a medical care provider holding information about patients in Georgia, protect the confidentiality of that information during the patient's life and after the patient's death, and disclose it only in a case Art. 28(1) lists, such as the patient's agreement.
Law on Patient Rights, genetic testing and genetic discriminationsince 2 lines
Law of Georgia on Patient Rights, Law No. 283 of , Arts. 31-32 · Read the law's page
- Do not discriminate against a person in Georgia because of genetic heritage.
- Identify genes responsible for disease, or test for genetic predisposition to a disease, only to protect the patient's health or to conduct healthcare-related scientific research.
Criminal Code of Georgia, disclosure of information on private life or of personal datasince 1 line
Criminal Code of Georgia, Law No. 2287 of , Art. 157 · Read the law's page
- Do not unlawfully obtain, store, use, disseminate or otherwise make available information on private life or personal data in a way that causes considerable damage; the offence is punishable by a fine or corrective labour for up to two years, or by imprisonment for up to three years.
National Bank of Georgia rule on registration and regulation of credit information bureaussince 3 lines
Order of the President of the National Bank of Georgia No. 193/04 of , Rule for Registration, Cancellation of Registration, and Regulation of a Credit Information Bureau, Arts. 2 to 4 and 14 · Read the law's page
- Operate as a credit information bureau or platform only after the National Bank of Georgia has registered the entity.
- Have an information security policy covering the confidentiality, integrity and availability of all data the bureau or platform holds, and have an external audit firm audit the information systems and technologies at least once a year.
- Submit to the National Bank's scheduled and unscheduled technical and financial audits and, when it demands, host the data server in a country that meets data security requirements.
National Bank of Georgia rule on providing information to and accessing a credit information bureausince 3 lines
Order of the President of the National Bank of Georgia No. 195/04 of , Rule for Providing Information to a Credit Information Bureau on the Territory of Georgia, Recording and Accessing Information in the Database of the Credit Information Bureau, Arts. 4, 5, 8 and 10 · Read the law's page
- Request or verify a person's information from a credit information bureau only for the solvency analysis of that person, and, if you are an information recipient that is not a lending organization, only on the basis of the person's consent.
- As a bureau, issue credit and other information about a person only to an authorized person in the cases the legislation and the Rule provide, and store information on repaid obligations for at least 35 years.
- Give a person, on request and free of charge, the information held about them, and review the person's claims about the accuracy of the records or processing without a legal basis.
Law on Personal Data Protection, biometric data articlesince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Art. 9; Art. 3(d) · Read the law's page
- An app that captures or stores a facial image, voiceprint, or other biometric identifier from a person in Georgia must have a necessity-based purpose recognized by Art. 9 or the data subject's consent, and must determine in writing, before processing begins, the purpose, volume, storage period, and destruction procedure for that biometric data.
Law on Personal Data Protection, breach notificationsince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 () · Read the law's page
- An app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights.
Law on Personal Data Protection, cross-border transfersince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 37-38, as amended by Law No. 1289 () · Read the law's page
- An app transferring the personal data of a person in Georgia to a recipient outside Georgia must rely on the destination being on the State Audit Office's adequacy list, a State Audit Office-permitted contractual safeguard, the data subject's informed written consent, or another Art. 37 statutory basis.
Law on Personal Data Protection, enforcement and penaltiessince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79 · Read the law's page
- An app processing the personal data of a person in Georgia must be prepared to answer to the State Audit Office's administrative-penalty powers; no private right of action exists under this Act itself.
Law on Personal Data Protection, data subject rightssince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Chapter III (Arts. 13-22) and Art. 23 · Read the law's page
- An app holding the personal data of a person in Georgia must give that person a way to withdraw consent and to appeal, and must act on a request to exercise their Chapter III rights on demand.
Law on Personal Data Protection, comprehensive regime and lawful basissince 1 line
Law of Georgia on Personal Data Protection, Law No. 3144-XI, adopted , Arts. 1-5, 7-8 · Read the law's page
- An app that collects, uses, or discloses the personal data of an individual in Georgia must establish a lawful basis for the processing under Art. 5 of the Law on Personal Data Protection.