GeorgiaLaw on Personal Data Protection, breach notification
In force since .
A breach notification rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Which incidents fall within the exception in Article 29(1) of the Law on Personal Data Protection for the case where "it is least expected that the incident would cause significant damage", and who decides that before the 72-hour period runs?
What it makes you log
Logging duty
Article 29(1) obliges the controller to register an incident, its resulting outcome and the measures taken, and to notify the State Audit Office within 72 hours of identifying it, unless significant damage is least expected. The items registered are outside the closed list of log contents. The notification and the notice to the data subject under Article 30 are reports, not access to the register; the Office's power to require registered information within three working days is in Article 28(3), which this row does not cite.
- Kind
- Explicit
- As of
- Provision
- Article 29(1)
- Trigger
- security_incident
What this law does
Art. 29 requires a controller to notify the State Audit Office of an incident within 72 hours of identification, in writing or electronically, with a defined content list covering the circumstances, type, and time; affected data categories, volume, and subject count; mitigation measures; planned data-subject notification timing; and DPO or contact details, unless it is least expected the incident would cause significant damage or pose a significant threat to fundamental rights.
Art. 30 requires notifying affected data subjects immediately or without unreasonable delay, in plain language, where there is a high probability of significant damage or a significant threat to fundamental rights, subject to narrower exceptions for state-security or public-safety categories, or where the controller already took measures preventing significant risk. This closely tracks General Data Protection Regulation (GDPR) Arts. 33-34's 72-hour authority-notification, risk-based subject-notification structure. Law No. 1289 of amended Article 29 to name the State Audit Office as the authority to be notified.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .