GeorgiaLaw on Personal Data Protection, comprehensive regime and lawful basis
Law of Georgia on Personal Data Protection, Law No. 3144-XI, adopted , Arts. 1-5, 7-8
In force since .
A comprehensive regime rule binding public and private bodies.
- Audit expectation
- none
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Georgia must establish a lawful basis for the processing under Art. 5 of the Law on Personal Data Protection.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- When does an "overriding interest in protecting the rights of the data subject" displace the ground of "important legitimate interests pursued by the controller or a third party" in Article 5(1)(i) of the Law on Personal Data Protection for an app's ordinary processing?
What it makes you log
Logging duty
Article 4(7) makes the controller responsible for, and able to demonstrate compliance with, the processing principles, and Article 5(2) obliges it to justify the legal basis for processing. Neither names a log or register. The register of processing and the logging of operations on electronic data are in Articles 27(4) and 28, which this row does not cite. Article 2(1) reaches processing within Georgia and a controller not established there that uses technical means available in Georgia; both prongs turn on where processing or equipment is located, which has no value in the territorial hook vocabulary, so the hook is left empty.
- Kind
- Implicit
- As of
- Provision
- Article 4(7); Article 5(2)
- Trigger
- personal_data_processing
What this law does
The Law of Georgia on Personal Data Protection, Law No. 3144-XI, adopted , replaced the 2011 Law on Personal Data Protection outright: Art. 89 declares the Law of invalid. Commencement was staged under Art. 90. Art. 90(1) brings into force upon promulgation only the provisions outside Arts. 1-87, 88(2) and (3) and 89, and the Legislative Herald records the Law's publication on .
Arts. 1-5, 6(1)(a)-(q), (2) and (3), 7-30, 32, 34-79, 81, 83-87, 88(2) and (3), and 89 entered into force on , and Arts. 31, 33, 80 and 82 on .
Art. 5(1) makes the processing of data admissible where one of ten listed grounds exists, among them the data subject's consent, the performance of a contract, a statutory duty of the controller, protection of vital interests, tasks in the public interest, and important legitimate interests pursued by the controller or a third party unless there is an overriding interest in protecting the rights of the data subject. Art. 5(2) obliges the controller to justify the legal basis for the processing. Art. 6 sets separate grounds for special categories of data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .