Georgia

Art. 3(d) defines biometric data as data processed using technical means and related to the physical, physiological or behavioural characteristics of a data subject, such as facial images, voice characteristics or dactyloscopic data, which allow the unique identification or confirm the identity of that data subject, naming voice and face directly rather than leaving them implicit, the closest match to General Data Protection Regulation (GDPR) Art. 4(14)'s formulation in this batch.

Art. 9 is a dedicated biometric-data article, independent of the Art. 6 special-categories list: biometric data may be processed only for an enumerated list of necessity-based purposes (security or property protection where no less-intrusive means exists, identity-document issuance, border-crossing identification, migration control, international-protection implementation, crime prevention and investigation, detention or sentence enforcement, minor-welfare coordination, operative-investigative activity, information or cyber security, or another case a law directly provides for), and Art. 9(2) requires the controller to determine in writing, before processing begins, the purpose and volume of the biometric data to be processed, its storage period, and its storage and destruction procedure and conditions.

Art. 13 requires the data subject's consent as the default basis, subject to those necessity-based exceptions.

Art. 29 requires a controller to notify the State Audit Office of an incident within 72 hours of identification, in writing or electronically, with a defined content list covering the circumstances, type, and time; affected data categories, volume, and subject count; mitigation measures; planned data-subject notification timing; and DPO or contact details, unless it is least expected the incident would cause significant damage or pose a significant threat to fundamental rights.

Art. 30 requires notifying affected data subjects immediately or without unreasonable delay, in plain language, where there is a high probability of significant damage or a significant threat to fundamental rights, subject to narrower exceptions for state-security or public-safety categories, or where the controller already took measures preventing significant risk. This closely tracks General Data Protection Regulation (GDPR) Arts. 33-34's 72-hour authority-notification, risk-based subject-notification structure. Both articles were touched by Law No. 1289 of 17 December 2025; the specific amendment text is not established here.

The Law of Georgia on Personal Data Protection, Law No. 3144-XI, adopted 14 June 2023, replaced the 2011 Law on Personal Data Protection outright: Art. 89 declares the 2011 law invalid. Commencement was staged under Art. 90: non-substantive provisions took effect on promulgation in June 2023, while the bulk of substantive articles, including Arts. 1-5, 7-30, 32, 34-79, 81, and 83-89, entered into force 1 March 2024.

Lawful bases sit at Art. 5, which is not set out article-by-article here; Art. 6's special-category grounds are read in full and recorded in a separate instrument.

Art. 37 permits cross-border transfer where the destination state or organization provides appropriate safeguards, through an international treaty, a controller-to-recipient agreement providing appropriate safeguards (which requires a State Audit Office permit under Art. 37(3)), specified statutory bases (criminal-procedure investigative cooperation, alien-status law, international law-enforcement cooperation, or anti-money-laundering and counter-terrorist-financing cooperation), the data subject's written consent after being informed of the destination's inadequate safeguards, vital-interest necessity, or a proportionate public-interest ground.

Art. 38 requires the State Audit Office to maintain and review, at least every three years, a published adequacy list assessed against the destination's international obligations, rights-protection guarantees, onward-transfer rules, and independent supervisory body. No data localization is compelled. Both articles were touched by Law No. 1289 of 17 December 2025; the specific amendment text is not established here.

Chapter III of the Act grants a data subject's rights; the penalty schedule (Arts. 72-75) confirms the chapter covers rights whose violation is separately sanctioned, including a right to withdraw consent (Art. 20), a right to appeal (Art. 22), and an obligation on the controller to protect data-subject rights on request (Art. 23).

The individual right-articles within Chapter III (Arts. 10-19) are not set out here, only the chapter's structure and its penalty cross-references, so the specific access, rectification, deletion, portability, and objection rights it grants are not established.

The State Audit Office, in its personal-data-protection function (administratively headed by the Head of the Personal Data Protection Service under Art. 88's transitional provisions), is Georgia's supervisory authority, a distinctive institutional choice housing the DPA inside the state audit body rather than a standalone commission.

Administrative penalties (Arts. 66-79) are flat sums rather than a percentage-of-turnover model; Art. 66, for a violation of processing principles, sets GEL 1,000 to 4,000 depending on entity type, turnover, and aggravating circumstances.

No private-right-of-action or civil-compensation provision was found within this Act itself; enforcement reads as regulator-only through the State Audit Office's administrative-penalty powers, though general Georgian civil or tort law may separately provide a damages route outside this Act, which is not addressed here.

Art. 6 lists special categories of data as race or ethnicity, political, religious, or philosophical belief, professional-union membership, health, sexual life, criminal-proceeding status, conviction or criminal record, trafficking or domestic-violence-victim status, and detention, plus biometric and genetic data processed to allow unique identification of a natural person, with 20 lawful grounds (a through t) for processing such data, far more elaborate than a bare consent-only rule; two of those twenty, Art. 6(1)(r) and Art. 6(1)(s), are not yet in force, each carrying its own later commencement date fixed by Article 90 of this Law, distinct from the 1 March 2024 date the rest of Art. 6 took effect on.

One of those grounds, Art. 6(1)(i), permits processing where the data subject has made the data publicly available without explicit prohibition of its use. Georgia's biometric-specific Art. 9 regime applies independently on top of any Art. 6 basis, so a biometric identifier is never governed by Art. 6 alone.

Article 284 punishes unauthorised access to a computer system by a fine or corrective labour of up to two years, or imprisonment for the same term, rising to imprisonment of two to five years for access committed by a group, using an official position, repeatedly, or resulting in substantial damage (over GEL 2,000), and to imprisonment of three to six years where the target is a critical information system subject.

Article 285 punishes unauthorised making, purchase, storage, sale, or dissemination of software, a password, an access code, or similar data for the purpose of committing a Chapter XXXV offence, by a fine or corrective labour of up to two years and/or imprisonment of up to three years, rising to three to six years for the aggravating circumstances listed above and to four to seven years against a critical information system subject.

Article 286 punishes unauthorised damage, deletion, modification, or concealment of computer data by a fine or corrective labour of up to two years and/or imprisonment for the same term, rising through the same aggravating tiers to three to five years and, against a critical information system subject, four to seven years.

The chapter's own note defines 'unauthorised' as illegal access or use, including where the right holder has not directly or indirectly transferred the right, without requiring that a technical security measure be defeated; because of that, and because no reported Georgian case addresses the point, whether reading a public, unauthenticated page without registration or login falls within these offences is unsettled rather than settled either way.

The Law of Georgia on Copyright and Related Rights, as consolidated through its most recent amendments, contains no exception permitting the automated reproduction of copyrighted works for text-and-data-mining, AI training, or computational analysis, and carries no machine-readable rights-reservation or opt-out scheme comparable to the one recognised under the EU's Digital Single Market Directive.

Its general exceptions, including the quotation exception at Article 23, are purpose-limited to scientific, research, polemic, critical, information, or teaching uses by their own terms, rather than to text-and-data-mining or model training as such. Reproducing or copying Georgian-hosted copyrighted content for AI training purposes without the rightsholder's authorisation or a licence therefore carries infringement risk unless a general exception genuinely fits the use.

Article 54 gives a database producer who confirms a substantial qualitative or quantitative investment in obtaining, verifying, or presenting the database's contents an exclusive right to prevent extraction or re-use of the whole content or a qualitatively or quantitatively significant part of it. That right runs for 15 years from the database's making, or from first lawful publication or communication to the public within that term.

Repeated or systematic extraction or re-use of insignificant parts is also prohibited where it conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests. This sui generis right is independent of copyright in the database's contents.

This chapter was added to the Act by Law No. 1585 of 3 June 2005 (Legislative Herald of Georgia, No. 31, 27 June 2005); the amending law's own commencement date is not stated in the provisions read, so the day this specific right took effect is not established here, though the right is presently in force.

Article 23(a) permits, without the author's consent and without paying royalties but with compulsory acknowledgement of the author and the source, quoting a work available to the public by lawful publication or communication to the public for scientific, research, polemic, critical or information purposes, only to the extent justified by the quotation purpose, including reproduction of excerpts from newspapers and magazines for a printed survey.

Article 23(c) separately permits reproducing articles or publicly transmitted works of similar content on current economic, political, social and religious issues through periodicals or public transmission, unless the author or another copyright holder has specially prohibited such reproduction, while the author retains the right to publish the work in a collection.

Neither paragraph carries a headline-length or short-extract cap distinct from its own purpose-limited test, and no reported Georgian decision applies either paragraph to a systematic news aggregator rather than an individual quoting a published work.