Georgia has no enacted AI-transparency, output-labelling, risk-obligation, training-data, prohibited-practice, governance, or sector-specific AI statute in force. Georgia signed the Council of Europe Framework Convention on Artificial Intelligence and Human Rights, Democracy and the Rule of Law (CETS No. 225) on , the day it opened for signature in Vilnius, but has not deposited an instrument of ratification, so the Convention binds Georgia to nothing yet.
The Law of Georgia on Personal Data Protection's automated-decision-making and profiling duties attach to personal data rather than to an AI system as such, and are a privacy-topic finding for this jurisdiction rather than an ai one.
Proposed.proposed Not law. It binds no one unless it is enacted.
Signed, with consent not yet expressed, dated , as of .Binds public and private bodies.
What this law does
Georgia signed the Convention on . Under Article 30(3) the Convention enters into force on the first day of the month following three months after five signatories, including at least three Council of Europe member states, have expressed their consent to be bound by it. The Convention covers the use of AI systems by public authorities, including private actors acting on their behalf, and by private actors generally.
It requires that activities within an AI system's lifecycle comply with fundamental principles including human dignity and individual autonomy, equality and non-discrimination, respect for privacy and personal data protection, transparency and oversight, accountability and responsibility, reliability, and safe innovation.
It requires documenting information about an AI system and its usage and making that information available to affected persons, sufficient to let them challenge a decision made through or substantially based on the system, and it requires an effective route to lodge a complaint with a competent authority.
It requires carrying out iterative risk and impact assessments of an AI system's actual and potential impacts on human rights, democracy, and the rule of law, with sufficient prevention and mitigation measures, and it lets a Party ban or impose a moratorium on certain AI applications. The Council of Europe's own tracker lists Georgia among the Convention's signatories rather than among the states that have ratified it.
Georgia's Law on Personal Data Protection, Law No. 3144-XI, adopted , replaced the 2011 law outright and commenced in stages: most substantive articles entered into force , with the data-protection-impact-assessment and Data Protection Officer articles following on , and later amendments, most recently Law No. 1694 of , have continued to touch core provisions, so this jurisdiction is fast-moving.
Art. 9 is a dedicated biometric-data article, independent of the Art. 6 special-categories list, permitting biometric processing only for an enumerated list of necessity-based purposes and requiring the controller to fix, in writing before processing begins, the purpose, volume, storage period, and destruction procedure; Art. 3(d) names facial images and voice characteristics directly as biometric-data examples, close to General Data Protection Regulation (GDPR) Art. 4(14)'s formulation.
Cross-border transfer (Arts. 37-38) runs on an adequacy list the State Audit Office reviews at least every three years, an authority-permit route for contractual safeguards, and consent, a real and conditioned regime. The Act itself creates no private right of action; enforcement is regulator-only through the State Audit Office's administrative-penalty schedule, with penalties set as flat sums rather than a percentage-of-turnover model.
Art. 157(1) of the Criminal Code of Georgia punishes unlawful obtaining, storage, use, dissemination or other making available of information on private life or personal data that has resulted in considerable damage with a fine or corrective labour for up to two years, or imprisonment for up to three years.
Art. 3(d) defines biometric data as data processed using technical means and related to the physical, physiological or behavioural characteristics of a data subject, such as facial images, voice characteristics or dactyloscopic data, which allow the unique identification or confirm the identity of that data subject, naming voice and face directly rather than leaving them implicit, the closest match to General Data Protection Regulation (GDPR) Art. 4(14)'s formulation in this batch.
Art. 9 is a dedicated biometric-data article, independent of the Art. 6 special-categories list: biometric data may be processed only for an enumerated list of necessity-based purposes (security or property protection where no less-intrusive means exists, identity-document issuance, border-crossing identification, migration control, international-protection implementation, crime prevention and investigation, detention or sentence enforcement, minor-welfare coordination, operative-investigative activity, information or cyber security, or another case a law directly provides for), and Art. 9(2) requires the controller to determine in writing, before processing begins, the purpose and volume of the biometric data to be processed, its storage period, its storage and destruction procedure and conditions, and the mechanisms for the protection of the rights of the data subject.
Art. 29 requires a controller to notify the State Audit Office of an incident within 72 hours of identification, in writing or electronically, with a defined content list covering the circumstances, type, and time; affected data categories, volume, and subject count; mitigation measures; planned data-subject notification timing; and DPO or contact details, unless it is least expected the incident would cause significant damage or pose a significant threat to fundamental rights.
Art. 30 requires notifying affected data subjects immediately or without unreasonable delay, in plain language, where there is a high probability of significant damage or a significant threat to fundamental rights, subject to narrower exceptions for state-security or public-safety categories, or where the controller already took measures preventing significant risk. This closely tracks General Data Protection Regulation (GDPR) Arts. 33-34's 72-hour authority-notification, risk-based subject-notification structure. Law No. 1289 of amended Article 29 to name the State Audit Office as the authority to be notified.
The Law of Georgia on Personal Data Protection, Law No. 3144-XI, adopted , replaced the 2011 Law on Personal Data Protection outright: Art. 89 declares the Law of invalid. Commencement was staged under Art. 90. Art. 90(1) brings into force upon promulgation only the provisions outside Arts. 1-87, 88(2) and (3) and 89, and the Legislative Herald records the Law's publication on .
Arts. 1-5, 6(1)(a)-(q), (2) and (3), 7-30, 32, 34-79, 81, 83-87, 88(2) and (3), and 89 entered into force on , and Arts. 31, 33, 80 and 82 on .
Art. 5(1) makes the processing of data admissible where one of ten listed grounds exists, among them the data subject's consent, the performance of a contract, a statutory duty of the controller, protection of vital interests, tasks in the public interest, and important legitimate interests pursued by the controller or a third party unless there is an overriding interest in protecting the rights of the data subject. Art. 5(2) obliges the controller to justify the legal basis for the processing. Art. 6 sets separate grounds for special categories of data.
Art. 37 permits cross-border transfer where the destination state or organization provides appropriate safeguards, through an international treaty, a controller-to-recipient agreement providing appropriate safeguards (which requires a State Audit Office permit under Art. 37(3)), specified statutory bases (criminal-procedure investigative cooperation, alien-status law, international law-enforcement cooperation, or anti-money-laundering and counter-terrorist-financing cooperation), the data subject's written consent after being informed of the destination's inadequate safeguards, vital-interest necessity, or a proportionate public-interest ground.
Art. 38 has the State Audit Office assess a destination's safeguards against its international obligations, rights-protection guarantees, onward-transfer rules, and independent supervisory body; the list of states and organizations found adequate is set by a normative act of the Auditor General and must be reviewed at least once every three years. No data localization is compelled.
Law No. 1289 of amended Article 37(3) so that the permit for a transfer under Article 37(2)(b) comes from the State Audit Office.
Chapter III of the Law (Arts. 13-22) sets out the data subject's rights: to obtain information on the processing of their data (Art. 13), to access the data and obtain a copy (Art. 14), to have erroneous, inaccurate or incomplete data rectified, updated or completed (Art. 15), to have the processing terminated and the data erased or destroyed (Art. 16), to have data blocked (Art. 17), to receive their data in a structured, commonly used and machine-readable format or have it transmitted to another controller (Art. 18), not to be subject to a decision based solely on automated processing, including profiling (Art. 19), to withdraw consent at any time and without explanation (Art. 20), and to apply to the State Audit Office of Georgia, to a court or to a superior administrative body when the Law is violated (Art. 22).
Art. 21 allows these rights to be restricted where the legislation of Georgia expressly provides for it, the restriction does not violate fundamental human rights and freedoms, and it is a necessary and proportionate measure in a democratic society, and the exercise of the rights may jeopardise interests such as national security or public safety.
Art. 23, in Chapter IV, obliges the controller, at the data subject's request, to ensure the exercise of the rights provided for by Chapter III and to demonstrate that it has taken the measures the Law requires, and extends that obligation to the processor.
Art. 157(1) of the Criminal Code of Georgia punishes unlawful obtaining, storage, use, dissemination or other making available of information on private life or personal data that has resulted in considerable damage with a fine or corrective labour for up to two years, or imprisonment for up to three years.
The State Audit Office is Georgia's personal-data supervisory authority: it reviews data subjects' applications (Art. 50), inspects controllers and processors (Art. 51) and applies corrective measures and administrative liability (Art. 52), and the Auditor General issues its subordinate normative acts (Art. 40(1)). That is a distinctive institutional choice, housing the DPA inside the state audit body rather than a standalone commission.
Law No. 1289 of provides for the liquidation of the Personal Data Protection Service on . The State Audit Office has been the legal successor of the Personal Data Protection Service since . Administrative penalties (Arts. 66-79) are flat sums rather than a percentage-of-turnover model; Art. 66, for a violation of processing principles, sets GEL 1,000 to 4,000 depending on entity type, turnover, and aggravating circumstances.
No private-right-of-action or civil-compensation provision was found within this Act itself; enforcement reads as regulator-only through the State Audit Office's administrative-penalty powers, though general Georgian civil or tort law may separately provide a damages route outside this Act.
Art. 6 lists special categories of data as race or ethnicity, political, religious, or philosophical belief, professional-union membership, health, sexual life, criminal-proceeding status, conviction or criminal record, trafficking or domestic-violence-victim status, and detention, plus biometric and genetic data processed to allow unique identification of a natural person, with 20 lawful grounds (a through t) for processing such data, far more elaborate than a bare consent-only rule; two of those twenty, Art. 6(1)(r) and Art. 6(1)(s), each carry their own later commencement date fixed by Article 90 of this Law, distinct from the date the rest of Art. 6 took effect on.
One of those grounds, Art. 6(1)(i), permits processing where the data subject has made the data publicly available without explicit prohibition of its use. Georgia's biometric-specific Art. 9 regime applies independently on top of any Art. 6 basis, so a biometric identifier is never governed by Art. 6 alone.
Georgia has no scraping-specific statute, so general law governs each dimension separately. The Criminal Code of Georgia's cybercrime chapter criminalises unauthorised access to a computer system and unauthorised interference with computer data or systems, but the offence turns on whether access or interference is unauthorised rather than on defeating a technical security measure, and no reported Georgian case addresses whether reading a public, unauthenticated page falls within it.
No Georgian court has ruled on the enforceability of a browsewrap or clickwrap terms-of-service against a scraper.
The Law of Georgia on Copyright and Related Rights confers a sui generis database producer right against unauthorised extraction or re-use of a database's contents, but carries no text-and-data-mining exception of the kind the EU's Digital Single Market Directive introduced, so training a model on scraped Georgian-hosted copyrighted content rests only on the Act's general, purpose-limited exceptions such as its quotation provision.
The Law of Georgia on Personal Data Protection (Law No. 3144-XI, 2023), already researched under this jurisdiction's privacy-topic document, applies to personal data without a general carve-out for information the data subject has made publicly available, so scraping personal data from a public Georgian website remains subject to that Act's lawful-basis, purpose-limitation, and cross-border-transfer duties; the seam rule files that duty under the privacy topic rather than restating it here.
No Georgian statute or reported case establishes a scraping-specific unfair-competition, misappropriation, or trespass doctrine, and none assigns legal weight to a robots.txt directive or imposes an AI-training-specific rule.
Article 284 punishes unauthorised access to a computer system by a fine or corrective labour of up to two years, or imprisonment for the same term, rising to imprisonment of two to five years for access committed by a group, using an official position, repeatedly, or resulting in substantial damage (over GEL 2,000), and to imprisonment of three to six years where the target is a critical information system subject.
Article 285 punishes unauthorised making, purchase, storage, sale, or dissemination of software, a password, an access code, or similar data for the purpose of committing a Chapter XXXV offence, by a fine or corrective labour of up to two years and/or imprisonment of up to three years, rising to three to six years for the aggravating circumstances listed above and to four to seven years against a critical information system subject.
Article 286 punishes unauthorised damage, deletion, modification, or concealment of computer data by a fine or corrective labour of up to two years and/or imprisonment for the same term, rising through the same aggravating tiers to three to five years and, against a critical information system subject, four to seven years.
The chapter's own note defines 'unauthorised' as illegal access or use, including where the right holder has not directly or indirectly transferred the right, without requiring that a technical security measure be defeated; because of that, and because no reported Georgian case addresses the point, whether reading a public, unauthenticated page without registration or login falls within these offences is unsettled rather than settled either way.
The Law of Georgia on Copyright and Related Rights, as consolidated through its most recent amendments, contains no exception permitting the automated reproduction of copyrighted works for text-and-data-mining, AI training, or computational analysis, and carries no machine-readable rights-reservation or opt-out scheme comparable to the one recognised under the EU's Digital Single Market Directive.
Its general exceptions, including the quotation exception at Article 23, are purpose-limited to scientific, research, polemic, critical, information, or teaching uses by their own terms, rather than to text-and-data-mining or model training as such. Reproducing or copying Georgian-hosted copyrighted content for AI training purposes without the rightsholder's authorisation or a licence therefore carries infringement risk unless a general exception genuinely fits the use.
Article 54 gives a database producer who confirms a substantial qualitative or quantitative investment in obtaining, verifying, or presenting the database's contents an exclusive right to prevent extraction or re-use of the whole content or a qualitatively or quantitatively significant part of it. That right runs for 15 years from the database's making, or from first lawful publication or communication to the public within that term.
Repeated or systematic extraction or re-use of insignificant parts is also prohibited where it conflicts with the database's normal exploitation or unreasonably prejudices the producer's legitimate interests. This sui generis right is independent of copyright in the database's contents. The right was in Article 54 of the Act as first enacted. Law No. 1585 of (Legislative Herald of Georgia, No. 31, ) later amended that article.
Georgia's principal information- and cyber-security statute is the Law of Georgia on Information Security (Law No. 6391-Is of , in force since ), most recently amended by Law No. 803-IIms-XIMp of (published ); the current consolidated text is published at Georgia's official legislative gazette, matsne.gov.ge. The Law binds only a critical information system subject that the Government of Georgia has individually designated by resolution, plus any organization or agency subordinate to, or connected by an employment, internship, contractual or other relationship with, such a subject that thereby provides access to its information assets (Art. 3(1)-(2)).
A designated subject falls into one of three criticality categories (Art. 2(z1)-(z3)): Category 1 covers a state or municipal body or institution, most public-law legal entities, and a state enterprise; Category 2 covers an electronic communications company as defined by the Law on Electronic Communications, so designated; and Category 3 covers a private-law legal person, so designated, which by the Law's own cross-reference includes a commercial bank the National Bank of Georgia has licensed.
Art. 3(3) excludes mass media, publishing houses, and scientific, educational, religious and public organizations and political parties from the Law regardless of the importance of their activity, and Art. 3(4) lets any non-designated legal person or public authority assume the Law's obligations voluntarily; a non-designated commercial bank instead follows rules the National Bank sets on its own.
The duties this regime places on a designated critical information system subject are filed as rows of their own.
What the regime requires of a designated subject: an internal information-security policy meeting minimum requirements the competent agency sets with reference to the standards of the International Organisation for Standardisation (ISO), the US National Institute of Standards and Technology (National Institute of Standards and Technology (NIST)) and the Information Systems Audit and Control Association (ISACA) (Art. 4); an inventory and criticality classification of its information assets (Art. 5); a primary and periodic information-security audit measuring compliance with those minimum requirements, plus penetration testing and vulnerability assessment, with a Category 1 subject's first audit performed free of charge by the Operational-Technical Agency (Art. 6); a designated Information Security Manager (Art. 7) and a separate Cyber Security Specialist responsible for the subject's day-to-day computer-system security, reachable at all times including after working hours (Art. 9); and a duty to identify, study, describe and respond to a computer incident, using a network sensor, and to notify the competent Computer Incident Assistance Group immediately once an incident is identified on the subject's network (Art. 10).
That notification duty carries no numeric clock beyond immediacy and creates no separate duty running to users or the public; a subject must then act on any mandatory instruction the Group issues within a reasonable time, capped at one month for a defence-sector subject (Art. 10(3), Art. 10-3(5)).
Which Group receives the notice, and which body sets the subject's minimum standards and audit schedule, depends on category and sector: a Category 1 or 2 subject answers to the Operational-Technical Agency, a public-law legal entity under the governance of Georgia's State Security Service (Art. 2(p)); a Category 3 subject answers to the Digital Governance Agency, under the Ministry of Justice (Art. 2(n)); and a critical information system subject in the defence sphere answers to the Cyber Security Bureau, under the Ministry of Defence (Art. 2(o), Arts. 10-1 to 10-3).
A 2023 amendment (Law No. 3506) added Art. 9-1, letting the Operational-Technical Agency order an on-site inspection of a Category 1 subject's information-technology infrastructure, including its internal network, connected hardware and software, and related documentation, with a duty to refer evidence of a crime to an investigative body.
Art. 8-2(1), added in 2021, separately lets the Government of Georgia set additional requirements tied to the country that manufactured the hardware or software a designated subject uses to receive, process, store or transmit data, a restriction on a designated subject's own procurement rather than a market-placement duty on a manufacturer generally.
Chapter III-2 ("Administrative liability for violation of this Law"), added by Law No. 632 of , fines a Category 1 or 3 subject a warning or GEL 5,000 for missing the deadline the Operational-Technical Agency or Digital Governance Agency sets for implementing minimum information-security requirements, rising to GEL 10,000 on a repeat violation within one year (Art. 10-4); the same GEL 5,000 rising to GEL 10,000 escalation separately punishes failing to meet additional Government-resolution requirements (Art. 10-5), failing to conduct the required audit or penetration test (Art. 10-6), and failing to notify a computer incident, comply with a mandatory instruction, or report on the remedial measures taken (Art. 10-8); failing to submit internal information-security rules for review, or to comply with a mandatory instruction concerning them, carries a higher GEL 10,000 rising to GEL 20,000 escalation (Art. 10-7); and a commercial bank that is a Category 3 subject instead faces a fine of 0.01%, 0.05% or 0.1% of its last-reported supervisory capital, never less than GEL 20,000, scaled to the seriousness of the violation (Art. 10-9(3)).
These are administrative penalties under Georgia's ordinary administrative-offences framework rather than criminal ones, and no published register of actions or fines under this chapter was found, so no enforcement record is stated here.
No instrument was found that sets security requirements a software product or connected device must meet before or after it is placed on the Georgian market; the vendor-country procurement rule at Art. 8-2(1) binds only a designated subject's own purchasing, not a manufacturer generally. No general reasonable-security or information-security-programme statute reaches an ordinary business that is not a designated critical information system subject.
A safeguards duty attaching to personal data itself already sits inside the comprehensive Law of Georgia on Personal Data Protection (Law No. 3144-XI, adopted ), this jurisdiction's privacy row, whose own breach-notification finding (Arts. 29-30) is not repeated here. Georgia has amended the Law on Information Security five times since 2020, most recently in June 2025, so this jurisdiction is recorded as fast-moving.
Article 3 of the Law of Georgia on Information Security applies it to a critical information system subject that the Government of Georgia lists by resolution. Article 10(2) of that Law requires a critical information system subject to notify the competent Computer Incident Assistance Group immediately when a computer incident is identified.
Article 3 applies the Law to a critical information system subject. The Government of Georgia lists the subjects by resolution together with each one's criticality class. Article 4 requires the subject to adopt internal information-security rules that meet minimum requirements. Article 6 requires the subject to carry out an initial and periodic information-security audit.
Article 10-4 fines a Category 1 or Category 3 subject a warning or GEL 5,000 for missing the deadline set for the minimum requirements, and GEL 10,000 for a repeat within one year.
Article 10(2) requires a critical information system subject to notify the competent Computer Incident Assistance Group immediately when a computer incident is identified in its network. Article 10(1) requires the subject to use a network sensor to identify computer incidents. Article 10(3) requires the subject to respond to the Group's mandatory instruction within a reasonable time.
Article 10-8 fines a Category 1 or Category 3 subject a warning or GEL 5,000 for failing to notify, and GEL 10,000 for a repeat within one year.
Georgia has no press-publisher neighbouring right and no mandatory platform-to-publisher bargaining code; the general copyright framework of the Law of Georgia on Copyright and Related Rights (1999, as amended) is the only law reaching an aggregator's reproduction of news content.
Its quotation exception permits, without the author's consent and without paying royalties but with compulsory acknowledgement of the author and source, quoting a published work for scientific, research, polemic, critical or information purposes, including reproduction of excerpts from newspapers and magazines for a printed survey, and separately permits reproducing articles or publicly transmitted works on current economic, political, social or religious issues through periodicals unless the author has specially prohibited it.
Neither provision carries a headline-length or short-extract cap distinct from its own purpose-and-extent test, and no reported Georgian decision applies either to a systematic news aggregator as opposed to an individual quoting a published work.
The Act's related-rights chapter protects performers, phonogram and videogram producers, and broadcasting organisations, not a print or online news publisher's own reporting, so there is no publisher-side neighbouring right of the kind the European Union's Digital Single Market Directive Article 15 creates.
No statute or case law located addresses whether a hyperlink is itself a communication to the public, or whether framing or inline display changes the answer, and no hot-news or misappropriation doctrine distinct from ordinary copyright law was found. The Act's text carries no machine-readable text-and-data-mining reservation or opt-out mechanism.
Law of Georgia on Copyright and Related Rights adopted , Art. 23 (Use of Works Without the Author's Consent and Without Paying Him/Her Royalties)Law of Georgia on Copyright and Related Rights, official consolidated text, Legislative Herald of Georgia (Matsne)
In force since .Binds public and private bodies.
What this law does
Article 23(a) permits, without the author's consent and without paying royalties but with compulsory acknowledgement of the author and the source, quoting a work available to the public by lawful publication or communication to the public for scientific, research, polemic, critical or information purposes, only to the extent justified by the quotation purpose, including reproduction of excerpts from newspapers and magazines for a printed survey.
Article 23(c) separately permits reproducing articles or publicly transmitted works of similar content on current economic, political, social and religious issues through periodicals or public transmission, unless the author or another copyright holder has specially prohibited such reproduction, while the author retains the right to publish the work in a collection.
Neither paragraph carries a headline-length or short-extract cap distinct from its own purpose-limited test, and no reported Georgian decision applies either paragraph to a systematic news aggregator rather than an individual quoting a published work.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Age gating law
Georgia has no adult-content age-verification law, social-media minor-access restriction, app-store age-verification requirement, or age-appropriate design code. The Law of Georgia on Protecting Minors From Bad Influences (number 1081 of ) was declared invalid from by Article 100 of the Code on the Rights of the Child.
Chapter IX of that Code bars a child from staying in an internet salon or internet cafe without a parent or legal representative from 22:00 to 8:00. It requires an internet service provider to develop mechanisms enabling a user to block a child's access to information hazardous to the child on request.
It allows internet access to a child in a general educational institution, a library or a specialized childcare institution only where that institution has introduced technical means for blocking information hazardous to the child.
The Law of Georgia on the Protection of Family Values and Minors (number 4437-XVI of ) forbids a broadcaster from airing, and forbids providing to a minor through direct communication, information that popularises a person's assignment to a sex other than their biological sex or a same-sex relationship with an expressed sexual orientation, or incest; its duties run to broadcasters, advertisers, educational institutions and persons in direct physical or verbal communication with a minor, and it imposes no age-verification, age-gating, or age-threshold mechanism on an online service, a social media platform, or an app store.
As of .
Case law
No current case law for Georgia AI law
No current case law for Georgia privacy law
No current case law for Georgia scraping law
No current case law for Georgia cybersecurity law
No current case law for Georgia communications law
No current case law for Georgia content moderation law
No current case law for Georgia product and AI liability law
No current case law for Georgia digital accessibility law
No current case law for Georgia age gating law
No current case law for Georgia reuse law
Reporting clocks that run here2 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Georgia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
An app that suffers an incident affecting the personal data of a person in Georgia must notify the State Audit Office within 72 hours of identification, and must notify affected data subjects immediately or without unreasonable delay where there is a high probability of significant damage or a significant threat to their fundamental rights.
Notify the Computer Incident Assistance Group of the Operational-Technical Agency (Category 1 and 2), the Digital Governance Agency (Category 3) or the Cyber Security Bureau (defence sphere) immediately when a computer incident is identified in your network; the Law sets no numeric clock (art. 10(2)).
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
