Data-protection compliance requires a specific processing purpose, lawful basis, data categories, retention period, recipients and a practical means to exercise data-subject rights. Blanket consent is not a universal basis. HR files, customer databases and CCTV recordings require distinct assessments.
Applicable legislation: Law of Georgia on Personal Data Protection
Building a processing inventory
Start with a processing inventory recording what data is collected, by whom, for what purpose, in which systems and to which recipients. Analyse personnel files, CCTV, contractors and customer web forms separately. The goal is to align actual practices with the record, not simply write a policy.
For instance, storing all rejected applicants’ CVs indefinitely is not justified merely by adding a consent heading. Identify the purpose, valid processing ground and enforceable deletion schedule.
Relevant statutory provisionApplying the rule in practice
A camera at a company reception does not automatically justify audio recording. Examine necessity, proportionality, notices, access rights, deletion rules and responsibility for handling individual requests.
Map processing activities
Identify every processing point: website forms, employee files, customer contracts, CCTV and marketing systems. Record the purpose, data categories, source, retention period and access rights. Start with actual practices, not a generic privacy-policy template.
Legal basis and transparency
Every processing activity requires an appropriate legal basis and clear information to the individual. A single blanket checkbox is not a universal compliance mechanism. Review recipients, outsourced processors and potential international transfers.
Operational safeguards
Set access controls, retention and deletion rules, an incident reporting channel and accountable personnel. Allocate roles and obligations in vendor contracts. A meaningful review covers technical and organisational measures together.
Website forms and transparency
For website forms, identify the information collected, the recipient system and retention approach. A 'Send' button alone is not comprehensive privacy information. Provide an appropriate notice, lawful basis and safeguards. Disclose the third-party provider if transmission uses one.
Employee records
Employee files may contain addresses, banking data, schedules and occasionally special-category information. Restrict access and define purposes. Employment ending does not always require immediate destruction of every record; retention must reflect applicable obligations. Indefinite retention without justification creates its own exposure.
Map processing before drafting policies
Copying a privacy policy does not establish compliance. Map the categories, source, purpose, legal basis, recipients, retention and access for each system. HR records, CCTV and customer CRM present different risks. Define how requests and incidents are handled, review third-party processors, and do not assume consent is the universal legal basis. Appropriate controls follow the actual processing operations.