GeorgiaLaw on Personal Data Protection, enforcement and penalties
Law of Georgia on Personal Data Protection, Law No. 3144-XI, Arts. 63-79
In force since .
An enforcement supervision rule binding public and private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- An app processing the personal data of a person in Georgia must be prepared to answer to the State Audit Office's administrative-penalty powers; no private right of action exists under this Act itself.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- What quantity of data counts as "processing large quantities of data subjects’ data" for the aggravating circumstance in Article 62(b) of the Law on Personal Data Protection, which raises the fines in Articles 66 to 87?
What it makes you log
Logging duty
Article 77 makes failure to register information related to data processing under Article 28 an administrative offence with a warning or a fine of GEL 1,000 to 1,500, doubled to GEL 2,000 to 3,000 where aggravated. The registration duty itself, and the logging of operations on electronic data in Article 27(4), sit in Articles 27 and 28, which this row does not cite, so the contents, audit and access values for those duties are not borrowed here. Article 76 sanctions a failure of the Article 27 security duty and Article 78 a failure to notify an incident.
- Kind
- Explicit
- As of
- Provision
- Article 77(1)
- Trigger
- personal_data_processing
What this law does
The State Audit Office is Georgia's personal-data supervisory authority: it reviews data subjects' applications (Art. 50), inspects controllers and processors (Art. 51) and applies corrective measures and administrative liability (Art. 52), and the Auditor General issues its subordinate normative acts (Art. 40(1)). That is a distinctive institutional choice, housing the DPA inside the state audit body rather than a standalone commission.
Law No. 1289 of provides for the liquidation of the Personal Data Protection Service on . The State Audit Office has been the legal successor of the Personal Data Protection Service since . Administrative penalties (Arts. 66-79) are flat sums rather than a percentage-of-turnover model; Art. 66, for a violation of processing principles, sets GEL 1,000 to 4,000 depending on entity type, turnover, and aggravating circumstances.
No private-right-of-action or civil-compensation provision was found within this Act itself; enforcement reads as regulator-only through the State Audit Office's administrative-penalty powers, though general Georgian civil or tort law may separately provide a damages route outside this Act.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .