Page 1

5669-rs

28/12/2011

Website, 16/01/2012

010100000.05.001.016606

On the protection of personal data

Documents

Home

about us

Help

public information

Login

Version of
forGeorgia
the disabled
The parliament

Registration

| ᲥᲐᲠ

Survey

return back

On the protection of personal data
document number

5669-rs

Recipient of the document

The parliament of Georgia

Date of receipt

28/12/2011

Document type

Law of Georgia

Source of publication, date

Website, 16/01/2012

Registration code

010100000.05.001.016606

Consolidated publications

29/11/2019

Consolidated version (final)
6

+

Law of Georgia
On the protection of personal data

Chapter I. General Provisions

+

Article 1. Purpose of the Law

+

The purpose of this law is to ensure the human rights and freedoms of those who process personal data
Among them, the protection of privacy.
Article 2. Definition of terms

+

The terms used in this law have the following meanings:
A) Personal data (hereinafter - the data) - any information related to the identified or
Identifiable natural person. A person is identifiable when it is possible to identify him directly or
Indirectly, in particular, by the identification number or characteristic of the person physical, physiological, psychological,
On economic, cultural or social grounds;
B) Special category data - data related to a person's race or ethnicity
In association with affiliation, political views, religious or philosophical beliefs
Membership, health status, sex life, conviction, administrative
Imprisonment, the imposition of a measure of restraint on a person, the conclusion of a plea agreement with a person,
Diversion, recognition as a victim of crime or identification as a victim, as well as biometric and
Genetic data that allows the identification of a natural person with the above traits;
C) Biometric data - a physical, mental or behavioral characteristic that is unique and permanent to each
For a natural person and with whom it is possible to identify this person (fingerprint, ankle finger, eye
Colored membrane, retinal membrane (retinal image), facial features);
C)1 Genetic data - unique and permanent data of the data subject on genetic inheritance and / or DNAThe code by which this person can be identified;
D) Data processing - data using automatic, semi-automatic or non-automatic means
Any action taken against it, in particular, collecting, recording, photographing, audio-recording, video-recording,
Organize, store, modify, restore, retrieve, use, or disclose data transmission, distribution, or
By making it otherwise available, grouping or combining, blocking, deleting or destroying;
E) Automatic data processing - processing of data using information technologies;
E)1 Semi-automatic data processing - using data information technologies and
Processing by non-automatic means;
F) Data subject - any natural person about whom data is processed;
G) Consent - after receiving the relevant information from the data subject, the data about him / her are defined
For the purpose of processing orally, by telecommunication or other appropriate means expressed voluntarily
Consent that can clearly determine the will of the data subject;
H) Written consent of the data subject - after receiving the relevant information by the data subject
Voluntary consent to the processing of data about it for a specified purpose by the data
The subject has signed or otherwise indicated in writing or in an equivalent form;
I) Data processor - a public institution, natural or legal person, which individually or
Defines, with others, the purposes and means of processing personal data, directly or indirectly
Carries out data processing through an authorized person;
J) Authorized person - any natural or legal person who processes the data
For the processor or on his behalf;
K) Data recipient - a private or public institution, natural or legal person, private or public sector
The employee to whom the data was transferred, other than the State Inspector Service;
L) Third party - any natural or legal person, public institution, except the data subject;
The Office of the State Inspector, the data processor and the authorized person;
M) File system - a structured set of data in which they are sorted and accessible
According to a specific criterion;
N) File system catalog - a detailed description of the structure and content of the file system;
O) File System Catalogs Registry - The registry that provides the existing file systems
Detailed accounting;
P) Data blocking - temporary suspension of data processing;
Q) Depersonalization of data - modification of data in such a way that it is impossible to connect them
Establishing such a relationship with a data subject or disproportionately large amount of effort, cost and time;
R) Identification number - a personal identification number or, as defined by law, with a natural person
Associated with any other identification number available from the file system (where
Identification number also processed) data retrieval or disclosure;
S) State Inspector - provided for by the Law of Georgia on the State Inspector Service
The official responsible for enforcing data protection legislation
For supervision;
T) Direct marketing - mail, telephone calls, e-mail or other telecommunications
Offer goods, services, employment or temporary work through;
U) (removed - 21.07.2018, №3274);
V) (removed - 21.07.2018, №3274);
ღ) (removed - 21.07.2018, №3274);
K) (removed - 21.07.2018, №3300);
Y) (removed - 21.07.2018, №3274);
Z) (removed - 21.07.2018, №3274);
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of November 30, 2014 № 2869 - website, 30.11.2014.
Law of Georgia of March 22, 2017 №479 - website, March 27, 2017.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of July 21, 2018 №3300 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 3. Scope of the Law

1

1. This Law shall apply to the territory of Georgia by automatic and semi-automatic means
Data processing, the processing of data by a file system by non-automatic means
Is part of or is being developed for the purpose of entering a file system, as well as for crime prevention and investigation,
For state secrets for operative-investigative measures and law enforcement purposes
Automatic processing of the assigned data, except for the exceptions provided for in this Article.
1.1 Processing of data by non-automatic means is not allowed if its purpose is in accordance with the requirements of this law
Avoidance for performance.
2. This Law shall also apply to:
A) Data by Georgian diplomatic missions and consular posts abroad
Processing;
B) the activities of a data processor who is not registered in the territory of Georgia, but
Uses technical means available in Georgia for data processing, unless it
The technical means are used only for data transit. In such a case the data processor
Must appoint / determine a representative registered in Georgia.
3. This law does not apply to:
A) the processing of data by a natural person for purely personal purposes when processing them
Not related to his entrepreneurial or professional activities;
B) the processing of data for the purposes of court proceedings, as this may be detrimental
Litigation before the court makes a final decision;
C) State security (including economic security), defense, intelligence and counterintelligence
Processing of data classified as state secrets for the purposes of activities;
D) information classified as a state secret (except as provided for in paragraph 1 of this article)
Data) processing.
4. This Law (except Article 17) does not apply to data media by the public
Processing for information purposes, as well as processing data for artistic and literary purposes.
5. Articles 19 and 20 of this Law shall not apply to political parties, professional parties, etc.
On the processing of data related to their members by associations and religious organizations.
6. The effect of Article 6 of this Law does not apply to public safety, operative-investigative
Data processing for the purpose of investigating measures and crime, if the issue is direct and specific
Regulated by the Criminal Procedure Code of Georgia or "On Operative-Investigative Activities"
By the law of Georgia or other special law.
7. Article 6 of this Law shall not apply to the Law of Georgia on Official Statistics
On data processing for the purpose of a general population census.
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
1
Article 3. For
the purpose of enforcing this law by the State Inspector and the Office of the State Inspector
With measures to be taken, as well as covert investigative actions and electronic
Activities carried out at the Central Bank for the identification of communication data
Control issues

+

For the purpose of enforcing this law by the State Inspector and the Office of the State Inspector
Measures to be taken, as well as covert investigative actions and electronic communications
Related to the control of activities carried out in the Central Bank of identifying data
The issues are defined by the Law of Georgia on the State Inspector.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 4. Principles of data processing

1

The following principles must be observed when processing data:
A) the data must be processed fairly and lawfully, without prejudice to the dignity of the data subject;
B) Data may be processed only for specific, clearly defined, legitimate purposes.
No further processing of the data for other purposes incompatible with the original purpose is permitted;
C) The data may be processed only to the extent necessary for the relevant lawful purpose
To achieve. The data must be adequate and proportionate to the purpose for which they are being developed;
D) The data must be true and accurate and, if necessary, updated. On a legal basis
Data collected without and inconsistent with the purpose of processing should be blocked, deleted or destroyed;
E) Data may be stored only for the period necessary for the purpose of the data processing
To achieve. Once the data is processed, it must be blocked, deleted, or deleted.
Must be destroyed or stored in a form that does not identify the person, unless otherwise provided by law
Established.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.

Chapter II. Data processing rules

+

Article 5. Basics of data processing

+

Data processing is allowed if:
A) there is the consent of the data subject;
B) data processing is provided by law;
C) Data processing is required by the data processor imposed on it by law
To perform duties;
D) data processing is necessary to protect the vital interests of the data subject;
E) data processing is necessary to protect the legitimate interests of the data processor or a third party;
Unless there is a superior protection of data subject rights and freedoms
Interest;
F) according to the law, the data are publicly available or made available by the data subject;
G) data processing is necessary to protect a significant public interest in accordance with the law;
H) Data processing is necessary to review the application of the data subject (services for him
To render).
(The normative content of Article 5, which excludes the result of an open court session
Issuance of the full text of court acts in the form of public information, to be declared invalid by 2020
From May 1) - Decision of the Constitutional Court of Georgia of June 7, 2019 №1 / 4 / 693,857 - website, 12.06.2019.
Article 6. Processing of special category data
1. Processing of special categories of data is prohibited.
2. The data referred to in paragraph 1 of this Article may be processed by the data subject
With written consent or in cases where:
A) It is necessary to process data related to conviction and health status
Depending on the nature of the employment obligations and the relationship, including the employment decision
To get;
B) data processing is necessary to protect the vital interests of the data subject or a third party; and
The data subject does not have the physical or legal capacity to consent to the processing of the data;
C) data is processed by a public health, health care or institution (employee)
By an individual for health care, as well as if it is necessary for the health care system
For management or operation;
D) the data subject has made public the data about him / her without explicitly prohibiting their use;
E) The data are processed by a political, philosophical, religious or professional association or non-profit
In carrying out legitimate activities by the organization. In such a case the data can be processed
Relate only to members or individuals of this association / organization who have a permanent connection to this
With the association / organization;
F) data is processed for the maintenance of personal files and registers of accused / convicts;
From his / her individual planning of serving a sentence against a convict and / or serving a sentence of a convict
With parole and a lighter sentence for the unserved part of the sentence
To discuss issues related to change;
G) data on "Crime Prevention, Rules for Execution of Non-custodial Sentences and Probation" shall be processed.
For the purpose of enforcing the legal acts provided for in Article 2 of the Law of Georgia;
G)1 Data are processed for re-socialization and rehabilitation of convicts and former prisoners, crime
To coordinate the implementation of prevention measures and the juvenile referral process;
H) the data are processed directly provided for by the Law of Georgia on International Protection
Cases;
I) data are processed for the operation of a unified migration data analysis system;
J) The data are processed to realize the right of education of persons with special educational needs
In order;
K) Data are processed on “Prevention of Violence against Women and / or Domestic Violence, Victims of Violence
To discuss the issue provided for in paragraph 2 of Article 11 of the Law of Georgia on Protection and Assistance
In order.
3. In case of data processing on the basis of paragraph 2 of this Article, the data subject is not allowed
Disclosure of data without consent and disclosure to a third party.
(The normative content of the first paragraphs of Article 6 and Article 3, which excludes open court
Issuance of the full text of court acts adopted as a result of the hearing in the form of public information;

+

To be declared invalid from May 1, 2020) - June 7, 2019 of the Constitutional Court of Georgia
Decision №1 / 4 / 693,857 - website, 12.06.2019.

Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of May 1, 2015 № 3534 - website, 18.05.2015.
Law of Georgia of April 27, 2016 № 5017 - website, 13.05.2016.
Law of Georgia of December 1, 2016 № 54 - website, 15.12.2016.
Law of Georgia of April 21, 2017 №669 - website, 03.05.2017.
Law of Georgia of September 20, 2018 №3451 - website, 09.10.2018.
Decision of the Constitutional Court of Georgia of June 7, 2019 №1 / 4 / 693,857 - website, 12.06.2019.
Law of Georgia of September 20, 2019 №5031 - website, 01.10.2019.
Law of Georgia of November 29 , 2019 № 5403 - website, 10.1 2.201 9.

Article 7. Protection of data on the deceased

+

1. Processing of data on the data subject after his / her death, except for the 5th and 6th of this law
On the grounds specified in Articles, the parent, child, grandchild or spouse of the data subject is allowed
With consent or if 30 years have passed since the death of the data subject.
2. Processing of data on a data subject after his / her death is also allowed, if it is
Necessary for the realization of inheritance rights.
3. The processing of data on the grounds provided for in paragraphs 1 and 2 of this Article shall not be permitted if:
The data subject was barred in writing prior to his death from data on his death
Then processing, except for processing the data on the grounds provided for in Articles 5 and 6 of this Law.
4. It is not necessary to process the name, sex, birth and date of death of the deceased.
Existence of the basis for data processing provided by law.
5. Data on the deceased may be disclosed historically, statistically and research-wise
For purposes other than when the deceased person has prohibited their disclosure in writing.
Law of Georgia of August 1, 2014 №2639 - website, 18.08.2014.

Article 8. Processing of data for direct marketing purposes

+

1. For direct marketing purposes may be processed from publicly available sources
Data.
2. Regardless of the purpose of the data collection, for the purposes of direct marketing the following i
Data: name (s), address, telephone number, email address, fax number.
3. Direct on the basis of a written consent issued by the data subject in accordance with the rules established by this Law
Any data can be processed for marketing purposes.
4. The data subject has the right to request data about him / her from the data processor at any time
Discontinue use for direct marketing purposes.
5. The data processor is obliged to stop processing data for the purposes of direct marketing and /
And ensure that the authorized person stops processing data for direct marketing purposes
No later than 10 working days after receiving the request of the data subject.
6. The data processor is obliged to process the data for direct marketing purposes
Notify the data subject of the right provided for in paragraph 4 of this Article and ensure that
The data subject should have the ability to discontinue processing of data for direct marketing purposes
The same form of demand as the form of direct marketing, and / or identify available and
Adequate means for requesting termination of data processing for direct marketing purposes.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.

Article 9. Processing of biometric data by a public institution

+

1. Biometric data may be processed by a public institution only for the safety and property of the person
For security purposes, as well as to prevent the disclosure of confidential information, if for those other purposes
It is impossible to achieve through or is associated with a disproportionately large effort.
2. Biometric data may be processed notwithstanding the conditions provided for in paragraph 1 of this Article
Issuance of an identity document or a person crossing the state border in accordance with the law
For the purpose of identification, as well as in other cases directly provided by the legislative act of Georgia.
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of December 1, 2016 № 54 - website, 15.12.2016.

Article 10. Processing of biometric data by a legal entity and a natural person under private law

+

Biometric data can be processed by a legal entity and a natural person under private law only in those
In case it is necessary to carry out activities, safety and property protection as well
For the purpose of preventing the disclosure of confidential information if these objectives are to be achieved by other means
Impossible or unjustifiably requires a lot of effort. Unless otherwise provided by law, biometric
Before using the data, the data processor must provide the same to the State Inspector's Service
The information provided to the data subject, in particular, the purpose of the data processing and
On security measures taken to protect data.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 11. Carrying out video surveillance on the street and public transport

+

1. On the street (including park, square, playground, public transport stop and other gathering
On the spot) and video surveillance in public transport is allowed only from the beginning of the crime
Avoidance, as well as harm to the safety and property of the person, public order and minors
For protection purposes.

2. In case of installing a video surveillance system, public and private institutions are obliged to be visible
Place an appropriate warning sign in place. In this case the data subject is considered to be about it
Informed about data processing.
3. The video surveillance system and video recordings must be protected from unlawful intrusion and use.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.

Article 12. Video surveillance of public and private institutions

+

1. Public and private institutions may carry out appropriate monitoring
Video surveillance of their buildings, if necessary for the safety and security of the person,
For the purposes of protecting a minor from harmful influences, protecting confidential information and testing.
2. Only the outer perimeter and entrance of the building can be accessed through the video surveillance system
Monitoring implementation. The data processor is obliged to place the relevant in a visible place
Warning sign. In this case the data subject about the processing of data about him
It is considered to be informed.
3. A video surveillance system can be installed in the workplace only in exceptional cases, if it is
It is necessary to protect the security and property of the person, to protect confidential information and to test / test
Goals and if these goals cannot be achieved by other means.
4. Video surveillance is not allowed in changing rooms and places intended for hygiene.
5. In the case provided for in paragraph 3 of this Article, when using a video surveillance system at the workplace
All persons employed in the relevant private or public institution must be informed in writing
On the implementation of video surveillance and its rights.
6. The data processor is obliged to create a file system for storing video recordings.
In addition to records (images / audio), the system should include information on the date, place and
About time.
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of December 26, 2018 №4145 - website, 10.01.2019.

Article 13. Video surveillance of a residential building

+

1. It is necessary to install a video surveillance system in a residential building for more than half of the owners of this building
Written consent. You must inform the occupants of the building about the installation of the video surveillance system.

2. Installation of a video surveillance system in a residential building is allowed only for the security of the person and property
For purposes.
3. It can be done only through the video surveillance system installed in the residential building
Monitoring of entrance and common space. Monitoring of owners' apartments is not allowed.
4. Monitoring the entrance of the apartment through the video surveillance system is allowed only in this apartment
By the decision of the owner or with his written consent.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.

Article 14. Data Processing Entry and Exit of Public and Private Institutions
For accounting purposes

+

1. Public and private institutions may collect for the purpose of registering entry into and exit from the building
The following data: name, number and type of identification document, address, entry and exit dates
And time, as well as reasons for entering and leaving the building.
2. The storage period of the data provided for in paragraph 1 of this Article shall not exceed the period of their recording
Three years from the date, unless otherwise provided by law. After the expiration of three years they must be deleted or
To be destroyed.
Chapter III. Rights and responsibilities of the data processor and the authorized person

+

Article 15. Provision of information to the data subject

+

1. If the data collection is carried out directly from the data subject, data processor or
The authorized person is obliged to provide the following information to the data subject:
A) The identity of the data processor and the authorized person (if any) and registered
Address;
B) the purpose of data processing;
C) it is mandatory or voluntary to provide data; If it is obligatory - it is legal to refuse it
results;
D) the right of the data subject to receive information about the processed data about him / her, to request their information
Fix, update, add, block, delete and destroy.
2. The provision of the information referred to in paragraph 1 of this Article is not mandatory if the data subject has already
Has it.
3. If data collection is not carried out directly from the data subject, data processor or
The authorized person is obliged to provide the data subject to the first paragraph of this article upon request
Mentioned information.
4. When collecting information for statistical, scientific and historical purposes, it is not provided
Mandatory if the data subject is provided with information disproportionately large
With effort.
Article 16. Data processing by an authorized person

+

1. An authorized person may process data with a legal act or data processor
On the basis of a written contract that must comply with this law and other regulations
The requirements established by the Acts and shall be subject to the rules and prohibitions established by this Law.
2. The authorized person must process the data as stipulated by the relevant legal act or contract
Within. No further processing of the data by the authorized person for any other purpose is prohibited.
It is not allowed for an authorized person to process data with another person with the consent of the data processor
Without transfer.
3. It is inadmissible to conclude an agreement on data processing if, from the activities of an authorized person and / or
Due to the objectives, there is a risk of improper data processing.
4. The data processor shall ensure that the person authorized to protect the data receives appropriate information
Organizational and technical measures. It is obliged to monitor the data by an authorized person
Processing.
5. In case of a dispute between the authorized person and the data processor, the authorized person
Is obliged to transfer the data available to the data processor upon request.
6. Abolition of the grounds or activities provided for in paragraph 1 of this Article by an authorized person
In the event of termination, data processing shall be discontinued prior to the cancellation of the said grounds or activities
Data processed prior to termination must be forwarded immediately to the data processor.
7. The contract with the authorized person should be provided for data security
Commitment to take action.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.

Article 17. Data Security

1

+

1. The data processor is obliged to take such organizational and technical measures as
Provides data protection against accidental or illegal destruction, alteration, disclosure,
From extraction, any other form of unlawful use, and from accidental or unlawful loss.
2. The data processor is obliged to provide the data in electronic form
Accounting for all actions performed. Data processing in non-electronic form
The processor is obliged to ensure that all data related to the disclosure and / or change
Action accounting.
3. Measures taken for data security Adequate to the risks associated with data processing
must be.
4. Any employee of the data processor and authorized person who participates in the data
In working conditions, he is obliged not to exceed the scope of the authority granted to him. In addition, it bears
Obligation to protect the confidentiality of data, including after the termination of his / her official authority.
5. Data security measures shall be determined by the legislation of Georgia.
Article 18. Obligations of the data processor and the authorized person with the disclosure of data
In connection with

+

When disclosing data, the data processor and the authorized person are obliged to ensure the following
Information registration: which data was disclosed, for whom, when and on what legal basis. this
Information about the data subject should be stored along with the data during their shelf life.
Article 19. Catalog of the file system

+

1. The data processor is required to run a file system for each file system
Catalog and record the following information:
A) the name of the file system;
B) Names and addresses of the data processor and authorized person, data storage and / or
Place of processing;
C) legal basis for data processing;
D) category of the data subject;
E) data category in the file system;
F) the purpose of data processing;
G) data storage period;
H) the fact and grounds for restricting the right of the data subject;
I) the recipient of the data stored in the file system and their categories;
J) information on the transfer of data to another state and international organization and such
Legal basis for the transfer;
K) General description of the procedure established for data security protection.
1
1. The
State Inspector's Office is obliged to maintain a register of file system catalogs. Mentioned

The information provided for in paragraph 1 of this Article shall be entered in the register. File systems
The information entered in the catalog of catalogs is public. The Office of the State Inspector provides this
Publish information in accordance with the rules established by the State Inspector.
2. The data processor is obliged to provide the information provided for in paragraph 1 of this Article
Systematic updates.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 20. Obligation to notify the State Inspector Service

+

1. The data processor is obliged to create a new category of data before creating a file system
Prior to filing, notify the State Inspector Service in writing or electronically of Article 19 of this Law
Information provided by Article.
2. The data processor is obliged to notify the State Inspector's Office under Article 19 of this Law
No later than 30 days after the change in the information provided.
3. Issuance of a permit for conducting a covert investigative action requested by a law enforcement body or its
1 copy of the judge's decision to refuse to hold a holding permit, containing only
Requisites and part of the resolution, as well as by a law enforcement body without the permission of the court
Judge's decision on declaring a covert investigative act lawful / illegal 1
A copy containing only the requisites and the resolution part shall be submitted to the State Inspector
To the Service in accordance with the rules established by the Criminal Procedure Code of Georgia.
4. An electronic communications company for an electronic communications law enforcement agency
Identifying data as established by Article 136 of the Criminal Procedure Code of Georgia
The transfer shall be notified to the State Inspector's Office within 24 hours after the transfer of this data.
5. In case of urgent necessity to conduct a covert investigative action by the prosecutor
A resolution containing only the requisites and the resolution part of the covert investigative action
No later than 12 hours from the start time specified in the resolution by the prosecutor or on the instruction of the prosecutor
The investigator submits the material (documentary) to the State Inspector's Service.
1

6. Article 143, Part 1, Subparagraph “a” of the Criminal Procedure Code of Georgia
A judge's ruling on the issuance of a permit to conduct a covert investigative action
An electronic copy containing only the requisites and the resolution part, as well as this hidden
An electronic copy of the prosecutor's decision on the conduct of the investigative action, which contains
Only the requisites and the part of the resolution, the legal entity of public law - the operative- of Georgia
Upon receipt by the Technical Agency, an electronic control shall be provided to the State Inspector's Office
Through the system.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of March 22, 2017 №479 - website, March 27, 2017.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Chapter IV. Data subject rights

+

Article 21. The right of the data subject to request information

+

1. The data subject has the right to request information about the data processor
On processing. The data processor must provide the following information to the data subject:
A) which data about it are processed;
B) the purpose of data processing;
C) legal basis for data processing;
D) how the data was collected;
E) to whom the data about him were issued, the basis and purpose of issuing the data.
2. Providing the data subject with the information provided for in sub-paragraph “e” of paragraph 1 of this article
It is not mandatory if the data is made public by law.
3. The data subject shall be provided with the information provided for in paragraph 1 of this Article upon request;
Immediately, or no later than 10 days after the request, if the request for information is answered:
A) searching and processing or consulting information in another institution or structural unit;
B) finding and processing significant volumes of unrelated documents;
C) with its structural subdivision or other public institution located in another settlement
Consultation.
4. The form of providing the information provided for in paragraph 1 of this Article shall be chosen by the data subject.
5. A person has the right to get acquainted with the personal data about him / her in a public institution free of charge
To receive copies of these data, except for the data for the issuance of which by the legislation of Georgia
A fee is provided.
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.

Article 22 - Correction, updating, addition, blocking, deletion and deletion of data by a data subject
The right to request destruction

+

1. At the request of the data subject, the data processor is obliged to correct, update,
Add, block, delete, or destroy data if it is incomplete, inaccurate, not updated, or if
Their collection and processing was carried out against the law.
2. The data processor must notify all data recipients of the data correction, update, addition,
About blocking, deleting or destroying it unless such information cannot be provided
Due to the abundance of data receivers and disproportionately large costs. Must be about the latter circumstances
Notify the State Inspector Service.
3. In case of receiving information in accordance with paragraph 2 of this Article, the receiving party shall be obliged to do so
Fix, update, add, block, delete or destroy data.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 23 - Procedure for correcting, updating, adding, blocking, deleting and destroying data

+

1. The request provided for in the first paragraph of Article 22 of this Law may be submitted in writing;
Orally or electronically.
2. Within 15 days after receiving the request of the data subject, the data processor is obliged to correct,
Update, add, block, delete or destroy data or notify data subject of denial
Grounds.
3. If the data processor, without the request of the data subject, considers himself / herself to be in his / her possession
The data is incomplete, inaccurate or not updated, he must correct or update the data accordingly and
This will inform the data subject.
4. Submission of a request by the data subject provided for in the first paragraph of Article 22 of this Law
The data processor is then authorized to block the data at the request of the applicant.
5. The decision to block the data shall be made within 3 days after the submission of the relevant request and
Valid for data processing, updating, adding, deleting and destroying data by the data processor
Before making a decision about.
6. The decision to block the data must be accompanied by the existence of the reason for the block
Relevant data.
Article 24. Restriction of the right of the data subject

+

1. The rights of the data subject provided for in Articles 15, 21 and 22 of this Law of Georgia
It may be restricted by law if the exercise of these rights could jeopardize:
A) the interests of state security or defense;
B) public safety interests;
C) detection, investigation and prevention of crime;
D) important financial or economic (including monetary, budgetary and tax) issues of the country
Related) interests;
E) the rights and freedoms of the data subject and others.
2. The measure provided for in paragraph 1 of this Article may be used only to the extent that
It is necessary to achieve the purpose of the restriction.
3. In the presence of the grounds provided for in paragraph 1 of this Article, the data processor or the State
The decision of the Inspector's Office shall be notified to the data subject in such a way as not to prejudice the right
The purpose of the restriction.
Law of Georgia of June 29, 2018 № 2765 - website, 19.07.2018.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 25. Refusal to consent

+

1. The data subject has the right, at any time, to refuse the explanation given by him without explanation
Consent and request termination of data processing and / or destruction of processed data.
2. The data processor is obliged to terminate the data at the request of the data subject
Process and / or destroy processed data within 5 days of application submission, if no
Other grounds for data processing.
3. This Article shall not apply to the performance of monetary obligations by a data subject
On information processed with consent.
Article 26. Right to appeal
1. A data subject has the right, in case of violation of the rights provided by this Law, by law
Apply to the State Inspector's Office or the court in the prescribed manner, and if the data processor
Is a public institution, a complaint can also be filed with the same or a higher administrative body.
The State Inspector shall consider the application of the data subject under this Law, “Service of the State Inspector
In accordance with the Law of Georgia and normative acts issued by the State Inspector.
2. The data subject has the right to request the data review body to block the data from the decision

+

Before removal.
3. The data subject has the right to a higher administrative body or the service of a state inspector
Appeal the decision in court in accordance with the law.
4. The origin of the dispute regarding the existence of the consent of the data subject on data processing
In this case, the data processor bears the burden of proving the existence of the fact of consent of the data subject.
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.
1
Article 26 (Removed)

+

Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of March 22, 2017 №479 - website, March 27, 2017.

Chapter V. (Deleted)

+

Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 27. (Deleted)

+

Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 28. (Deleted)
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 29. (Removed
Law of Georgia of August 1, 2014 №2639 - website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 30. (Deleted)
Law of Georgia of May 25, 2012 №6325 - website, 12.06.2012.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of March 20, 2015 №3350 - website, 31.03.2015.
Law of Georgia of December 6, 2018 №3879 - website, 14.12.2018.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 31. (Deleted)
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 32. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 33. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 34. (Deleted)
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 35. (Deleted)
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.
1
Article 35 (Removed)

Law of Georgia of November 30, 2014 № 2869 - website, 30.11.2014.
Law of Georgia of July 8, 2015 №3940 - website, 15.07.2015.
Law of Georgia of March 22, 2017 №479 - website, March 27, 2017.
Law of Georgia of July 21, 2018 №3300 - website, 09.08.2018.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 36. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 37. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 38. (Deleted)
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 39. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of August 1, 2014 №2636 - website, 18.08.2014.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 40. (Deleted)
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Chapter VI. Transfer data to another state and international organization

+

Article 41 - Transfer of data to another state and international organization

+

1. Data may be transferred to another State or international organization if this is the case
Basics of data processing provided by law and whether in the relevant state or internationally
Adequate data protection guarantees are provided in the organization.
2. Transfer of data to another state and international organization, except for the first paragraph of this article;
You can also if:
A) data transfer is envisaged by the international treaty and agreement of Georgia;
B) The data processor ensures proper data protection guarantees for the data subject and the data subject
The protection of the fundamental rights of the data processor and the State concerned, the law of such State or
On the basis of an agreement concluded between a natural person or an international organization.
3. The transfer of data on the basis of subparagraph "b" of paragraph 2 of this Article may be made only to the state inspector
After obtaining a service permit.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 42. Establishment of appropriate data protection guarantees

+

Assess the existence of adequate data protection guarantees in another state and / or international organization
And the decision is made by the State Inspector's Data Processing Regulator
Based on legislation and practice analysis.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Chapter VII. Administrative liability for violation of this law

+

Article 43. Processing of data without grounds provided by this Law

+

1. Processing of data without grounds provided by this Law Will result in a warning or a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
Page 2

For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 2,000.
Article 44. Violation of data processing principles

+

1. Violation of data processing principles provided by this Law Will result in a warning or a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 2,000.
Article 45. Processing of special categories of data without the grounds provided by this Law
+

1. Processing of special category data without the grounds provided by this Law Will result in a fine of GEL 1,000.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 5,000.
Article 46. Failure to comply with data security requirements

+

1. Failure to comply with the requirements established by this Law for data security protection Will result in a warning or a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of 2000 GEL.
Article 47. Use of data for direct marketing purposes in violation of the rules

+

1. Use of data for the purposes of direct marketing in violation of the rules established by this Law Will result in a fine of GEL 3,000.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 10,000.
Article 48. Violation of video surveillance rules

+

1. Violation of the video surveillance rules established by this Law Will result in a warning or a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 2,000.
Article 49. Data on entering and leaving the building of public and private institutions
Violation of processing rules

+

Processing of data on entry and exit of public and private institutions
Violation of the rules established by law Will result in a warning or a fine of GEL 100.
Article 50. Violation of the rules of informing the data subject by the data processor

+

1. Violation of the rules established by this law for informing the data subject by the data processor Will result in a warning or a fine of GEL 100.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 500.
Article 51. Assignment of rules to a person authorized to process data by a data processor
In violation

+

1. Assignment of the data processor to the authorized person for data processing by this Law
Violation of established rules Will result in a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of 2000 GEL.
Article 52. Violation of the rules provided for in Article 16 of this Law by an authorized person

+

1. Violation of the rules provided for in Article 16 of this Law by an authorized person Will result in a fine of 1000 GEL.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 3,000.
1
Article 52 Violation
of the rules of data transfer to another state and international organization

+

1. Transfer of data in violation of the rule established by Article 41 of this Law Will result in a fine of 1000 GEL.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 3,000.
Law of Georgia of August 1, 2014 №2639- website, 18.08.2014.

Article 53. Non-fulfillment of the request of the State Inspector Service

+

1. Information provided to the State Inspector by a data processor or authorized person
And violation of the rule of submission of a document, including the information specified in Article 10 of this Law
Non-delivery and non-fulfillment of the notification obligation provided for in Article 20, Will result in a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of GEL 2,000.
Law of Georgia of August 1, 2014 №2639 - website, 18.08.2014.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.

Article 54. Violation of other rules related to data processing

+

1
1. Violation of the rule established by paragraph
1 of Article 3 of this Law -

Will result in a fine of GEL 500.
2. The same act committed by a person who has been sentenced to an administrative penalty for one year
For the violation provided for in paragraph 1 of Article, Will result in a fine of 2000 GEL.
Law of Georgia of August 1, 2014 №2639 - website, 18.08.2014.

Article 55. Consideration of an administrative violation case

+

1. Review of cases of administrative offenses provided for in Articles 43-54 of this Law and
The State Inspector's Office has the right to impose administrative fines.
2. The protocol of administrative violation shall be drawn up by the State Inspector's Office for that purpose
Authorized person.
3. A person authorized by the State Inspector's Office shall draw up a report on an administrative offense
And the case of administrative violation is considered for administrative violations of Georgia
According to the Code, the Law of Georgia on the State Inspector Service and by the State Inspector
In accordance with the rules established by normative acts.
Law of Georgia of July 21, 2018 №3274 - website, 09.08.2018.
Law of Georgia of December 27, 2018 №4253 - website, 29.12.2018.
Law of Georgia of May 8, 2019 №4597 - website, 08.05.2019.
1 Transitional Provisions
Chapter VII.

+

Law of Georgia of November 30, 2014 № 2869 - website, 30.11.2014.
1
Article 55 Transitional
Provisions

+

The Ministry of Internal Affairs of Georgia shall provide an electronic control system by March 31, 2015
And technical equipment necessary for the operation of a special electronic control system for databases
Implement organizational activities and create appropriate software tools.
Law of Georgia of November 30, 2014 № 2869 - website, 30.11.2014.

Chapter VIII. Final Provisions

+

Article 56. Enactment of the Law

+

1. This Law, except for Articles 43-55 of this Law, shall enter into force on May 1, 2012.
2. Articles 43-55 of this Law shall enter into force on January 1, 2013.
3. Articles 34, 35 and 39 of this Law shall enter into force for the private sector from November 1, 2014 .
Law of Georgia of August 1, 2014 №2639 - website, 18.08.2014.

The President of Georgia M. Saakashvili
Tbilisi,
December 28, 2011.
665669-rs
22. 29/11/2019 - Law of Georgia - 5403-I - Website, 10/12/2019
21. 20/09/2019 - Law of Georgia - 5031-I - Website, 01/10/2019
20. 07/06/2019 - Decision of the Constitutional Court - 1/4 / 693,857 - Website, 12/06/2019
19. 08/05/2019 - Law of Georgia - 4597-rs - Website, 08/05/2019
18. 26/12/2018 - Law of Georgia - 4145-rs - website, 10/01/2019
17. 27/12/2018 - Law of Georgia - 4253-rs - website, 29/12/2018
16. 06/12/2018 - Law of Georgia - 3879-rs - website, 14/12/2018
15. 20/09/2018 - Law of Georgia - 3451-I - Website, 09/10/2018
14. 21/07/2018 - Law of Georgia - 3300-rs - website, 09/08/2018
13. 21/07/2018 - Law of Georgia - 3274-rs - website, 09/08/2018
12. 29/06/2018 - Law of Georgia - 2765-II - Website, 19/07/2018
11. 21/04/2017 - Law of Georgia - 669-II - Website, 03/05/2017
10. 22/03/2017 - Law of Georgia - 479-IIs - Website, 27/03/2017 - The amendment contains a transitional provision
9. 01/12/2016 - Law of Georgia - 54-I - Website, 15/12/2016
8. 27/04/2016 - Law of Georgia - 5017-II - Website, 13/05/2016
7. 08/07/2015 - Law of Georgia - 3940-rs - website, 15/07/2015
6. 01/05/2015 - Law of Georgia - 3534-II - Website, 18/05/2015
5. 20/03/2015 - Law of Georgia - 3350-II - Website, 31/03/2015
4. 30/11/2014 - Law of Georgia - 2869-I - Website, 30/11/2014
3. 01/08/2014 - Law of Georgia - 2639-rs - Website, 18/08/2014
2. 01/08/2014 - Law of Georgia - 2636-rs - website, 18/08/2014
1. 25/05/2012 - Law of Georgia - 6325-I - Website, 12/06/2012

Feedback

Online consultation
LEPL "Legislative Herald of Georgia" 2010-2021, all rights reserved.

developed AzRy © LTD by

