Law of Georgia on Personal Data Protection

Prepared by Shubhank Suman · Last reviewed 20 September 2026

CURRENT / IN FORCE (Articles 1–87 from 1 March 2024)

Legal character: Statute
Region: Europe

What it covers

Georgia's comprehensive data-protection law, closely modelled on the GDPR. It applies to automated processing and filing-system processing in Georgia, and to controllers not established in Georgia that use technical means in Georgia (other than for transit). It sets processing principles and legal grounds, special-category data rules, data-subject rights, controller and processor duties, incident notification, transfers abroad, the powers of the Personal Data Protection Service, and administrative fines.

Why it matters

It replaced Georgia's 2011 law with a modern GDPR-style regime, relevant to anyone processing data in Georgia or using technical means there.

Refer to it when

Use it for processing personal data in Georgia, data-subject requests, incident notification, transfers out of Georgia or fines imposed by the Personal Data Protection Service.

AI, privacy and cybersecurity relevance

AI: Low
Privacy: Very High
Cyber: Moderate

LOW RELEVANCE

Applies to AI only where personal data is processed.

Privacy

VERY HIGH RELEVANCE

Core comprehensive data-protection statute for Georgia.

Cybersecurity

MODERATE RELEVANCE

Data-security and incident-notification duties.

Applicability

Controllers and processors in Georgia, and non-established controllers using technical means in Georgia.

Current validity

CURRENT / IN FORCE. The supplied copy is a consolidated version for 02/04/2025–13/05/2025 and notes it is not the latest edition; amendments of 5 September 2024 and 6 February 2025 are listed. Read the official PDF on this page for the operative text.

Read first

Article 2 (scope) → definitions and principles → data-subject rights → controller duties and incidents → sanctions → Article 90.

Provisions / sections covered

Article 2 – Scope

Territorial reach and exclusions (household activity, national security, court proceedings, media, academic, artistic or literary purposes).

Chapter on data-subject rights

Rights to information, access, rectification, erasure, restriction, portability and objection.

Personal Data Protection Service

Supervision, inspections and lawful requests (Article 51).

Administrative offences (to Article 87)

Warnings and fines in GEL, higher for legal persons and repeat offences.

Article 90 – Entry into force

Most of the Law (Articles 1–87 and others) took effect on 1 March 2024.

Subject-matter tags

Data subject rights
Erasure and deletion
Data portability
Automated decision-making
Controller and processor
Enforcement and penalties

Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.

Document page in the Knowledge Base - full text or PDF where it is available for this record.

This library locates primary and official sources. It does not interpret the law and it is not legal advice.