Compliance begins with a defined legal basis, purpose and retention period; a privacy notice alone is not enough.
Applicable legislation: Law of Georgia on Personal Data Protection
DPO and allocation of responsibility
Whether a data protection officer is required cannot be decided from staff headcount alone. Assess processing categories, scale and the statutory triggers. Appointment of a DPO does not transfer away the controller’s obligation to process lawfully.
Map recruitment CVs, employee records, CCTV, web forms, marketing lists and service-provider transfers. For every flow record the purpose, legal ground, retention period, authorised access and deletion mechanism.
Relevant statutory provisionData mapping and legal basis
Separate employee, customer, supplier and website-visitor data. For each group, document purpose, lawful basis, retention, internal access and processors. Payroll bank details and an address used for promotional emails need not have identical legal bases.
When a data protection officer is required
Assess whether Georgian statutory DPO requirements apply to your organisation and processing activities; appointment is not automatically mandatory for every enterprise. Define independence, conflicts, reporting lines and the public contact channel.
When GDPR may also apply
EU GDPR does not displace Georgian legislation. Offering goods or services to people in the EU or monitoring their behaviour may bring GDPR territorial rules into scope. An English website or occasional European visitor alone does not establish targeted activities.
Incidents and data-subject requests
Maintain an incident log recording detection, affected records, people, access and containment. Establish a workflow for access, correction and erasure requests. Verify notification deadlines under the applicable Georgian or EU regime rather than assuming the two are interchangeable.
Processor agreements and security
Where CRMs, email tools, hosting or outsourced accounting process personal information, document instructions, security, subcontractors, deletion or return and incident escalation. A common failing is introducing vendors without defining their access by contract.