Law on Personal Data Protection, breach notification

Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 29-30, as amended by Law No. 1289 (17 December 2025)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 March 2024.

A breach notification rule binding public and private bodies.

As of 29 August 2026.

What it requires

An app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights.

Who checks it

Audit expectation

none

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Art. 29 requires a controller to notify the State Audit Office of an incident within 72 hours of identification, in writing or electronically, with a defined content list covering the circumstances, type, and time; affected data categories, volume, and subject count; mitigation measures; planned data-subject notification timing; and DPO or contact details, unless it is least expected the incident would cause significant damage or pose a significant threat to fundamental rights.

Art. 30 requires notifying affected data subjects immediately or without unreasonable delay, in plain language, where there is a high probability of significant damage or a significant threat to fundamental rights, subject to narrower exceptions for state-security or public-safety categories, or where the controller already took measures preventing significant risk. This closely tracks General Data Protection Regulation (GDPR) Arts. 33-34's 72-hour authority-notification, risk-based subject-notification structure. Both articles were touched by Law No. 1289 of 17 December 2025; the specific amendment text is not established here.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
processes_biometrics
processes_voice

Read the law

official statute text, Legislative Herald of Georgia (Matsne)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app