GeorgiaLaw on Personal Data Protection, cross-border transfer
In force since .
A cross border transfer rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of a person in Georgia to a recipient outside Georgia must rely on the destination being on the State Audit Office's adequacy list, a State Audit Office-permitted contractual safeguard, the data subject's informed written consent, or another Art. 37 statutory basis.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a transfer to a state whose safeguards the State Audit Office has not assessed under Article 38 of the Law on Personal Data Protection need a permit under Article 37(3) when the controller relies on Article 37(1) rather than on the agreement ground in Article 37(2)(b)?
What it makes you log
Logging duty
Articles 37 and 38 allow transfers to another state on adequate safeguards, a treaty, an agreement backed by a State Audit Office permit, written consent after information on the lack of safeguards, or a public-interest ground, and make the Office assess adequacy and review its list at least every three years. They require organisational and technical measures to safeguard a transfer but no log, register or record, and the three-year review is the Office's own review of its list, not an audit of a record.
- Kind
- None
- As of
What this law does
Art. 37 permits cross-border transfer where the destination state or organization provides appropriate safeguards, through an international treaty, a controller-to-recipient agreement providing appropriate safeguards (which requires a State Audit Office permit under Art. 37(3)), specified statutory bases (criminal-procedure investigative cooperation, alien-status law, international law-enforcement cooperation, or anti-money-laundering and counter-terrorist-financing cooperation), the data subject's written consent after being informed of the destination's inadequate safeguards, vital-interest necessity, or a proportionate public-interest ground.
Art. 38 has the State Audit Office assess a destination's safeguards against its international obligations, rights-protection guarantees, onward-transfer rules, and independent supervisory body; the list of states and organizations found adequate is set by a normative act of the Auditor General and must be reviewed at least once every three years. No data localization is compelled.
Law No. 1289 of amended Article 37(3) so that the permit for a transfer under Article 37(2)(b) comes from the State Audit Office.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .