Data protection & privacy law in Georgia (2026)

Legal framework

Law of Georgia on Personal Data Protection (No. 3144/2023); supervisory authority: Personal Data Protection Service (PDPS / pdps.ge)

Key points: data & privacy in Georgia

1. 01Comprehensive GDPR-aligned law

   Law No. 3144/2023, adopted 14 June 2023, establishes data-protection principles (lawfulness, purpose limitation, data minimisation, accuracy, storage limitation, integrity) closely mirroring the EU GDPR. It replaced the 2011 Personal Data Protection Law.

   matsne.gov.ge pdps.ge

2. 02Phased implementation

   Core provisions took effect 1 March 2024; Data Protection Impact Assessment and DPO obligations from 1 June 2024; further provisions being phased in from January 2025 through January 2027.

   eufordigital.eu ibccs.tax

3. 03Data subject rights

   Individuals hold rights of access, rectification, erasure, data portability, restriction of processing, and objection to direct marketing, mirroring GDPR Chapter III rights.

   pdps.ge assets.kpmg.com

4. 04Mandatory DPO sectors

   Appointing a Data Protection Officer is mandatory for government bodies, commercial banks, insurance firms, microfinance organisations, electronic communications companies, healthcare institutions, airlines/airports, credit bureaux, and entities processing data on more than 3% of Georgia's population or more than 1% of special-category data.

   assets.kpmg.com dlapiperdataprotection.com

5. 05Supervisory authority and enforcement

   The Personal Data Protection Service (PDPS) is an independent state authority empowered to conduct scheduled and unscheduled inspections, investigate complaints, and impose fines. In 2024 it conducted 265 inspections and received 1,662 data-subject applications. Fines range from GEL 1,000 to a maximum of GEL 20,000 per single inspection.

   old.pdps.ge eulawenforcement.com

6. 06EU association alignment

   The reform was driven in part by Georgia's EU Association Agreement and candidate-country aspirations; the law was developed with EU4Digital support and is explicitly modelled on the GDPR framework to harmonise Georgian data-protection standards with EU requirements.

   eufordigital.eu eulawenforcement.com

Timeline of decisions

1. 2 Mar 2026Decision
   State Audit Office Formally Assumes Data-Protection Supervisory Mandate

   The Personal Data Protection Service ceased to exist and all its functions — complaints, inspections, covert-surveillance oversight, and fining authority — transferred to the State Audit Office of Georgia (SAO). Civil-society groups warned that embedding data-protection oversight inside a general audit body risks undermining the independence required by international standards.

   Georgia Today

2. 17 Dec 2025Law · official
   Amendments Expand Legal Bases for Sensitive and Biometric Data Processing

   Law No. 1289 amended the Personal Data Protection Law to add new permissible grounds for processing sensitive personal data (Article 6) and biometric data (Article 9), mirroring GDPR Article 9 exemptions. The amendments became effective on March 2, 2026 alongside the SAO transfer.

   Georgian Legislative Herald (Matsne)

3. 31 Mar 2017Decision · official
   Operative Technical Agency (OTA) established; surveillance framework overhauled

   Following the April 2016 Constitutional Court ruling, parliament enacted new surveillance legislation on 31 March 2017 and established the Operative Technical Agency (OTA) under the State Security Service to manage lawful-interception infrastructure. The reform abolished the prior 'two-key' direct-access system, shifted judicial authorisation to the Supreme Court, and granted the Personal Data Protection Inspector oversight of surveillance legality.

   Operative Technical Agency of Georgia

4. 14 Apr 2016Decision
   Constitutional Court strikes down metadata retention and real-time ISP surveillance access

   On 14 April 2016, Georgia's Constitutional Court ruled that mandatory two-year metadata retention by ISPs and unrestricted real-time access to telecommunications networks by security agencies were unconstitutional. The court set 31 March 2017 as the deadline for parliament to enact a compliant replacement framework, directly triggering the 2017 surveillance reform.

   Civil Georgia

5. 14 Apr 2016Decision
   Constitutional Court Strikes Down Unrestricted Telecom Surveillance Access

   The Constitutional Court ruled that the Ministry of Internal Affairs' direct, unrestricted access to telecommunications networks was unconstitutional, finding that existing oversight mechanisms were insufficiently robust against unjustified interference with privacy. The court also invalidated blanket metadata-retention rules and ordered corrective legislation by March 31, 2017.

   OCCRP (reporting Constitutional Court of Georgia ruling)

6. 31 Mar 2015Law
   Two-Key Covert Surveillance Authorization System Introduced

   A mandatory dual-authorization regime for telecommunications interception took effect: both the security service and the Personal Data Protection Inspector's Office were required to approve each covert intercept, giving the Inspector an active gatekeeping role. The reform responded to sustained civil-society pressure over mass-surveillance concerns revealed in prior years.

   Civil Georgia

7. 1 Jul 2013Decision
   Office of the Personal Data Protection Inspector Becomes Operational

   Georgia established its first dedicated data-protection supervisory authority. The Inspector was empowered to receive and investigate data-subject complaints, conduct on-site inspections of controllers, issue binding recommendations, and — uniquely — oversee the legality of covert investigative actions by law enforcement and intelligence agencies.

   International Red Cross Conference Pledge Report

8. 28 Dec 2011Law · official
   Georgia Enacts Its First Law on Personal Data Protection

   Parliament adopted Law No. 5669-RS 'On Personal Data Protection', Georgia's first comprehensive statutory framework for privacy. It established core principles (purpose limitation, data minimisation, consent), created rights for data subjects to access and correct their data, and imposed obligations on data controllers — forming the legal foundation that remained in place for over twelve years.

   Georgian Legislative Herald (Matsne)

Sources

1. 1.matsne.gov.ge/en/document/view/5827307
2. 2.pdps.ge/files/content/LAW%20OF%20GEORGIA%20ON%20PERSONAL%20DATA%20PROTECTION_
3. 3.eufordigital.eu/new-data-protection-law-taking-effect-in-georgia/
4. 4.assets.kpmg.com/content/dam/kpmg/ge/pdf/2023/12/Personal-Data-Guide-ENG.pdf
5. 5.eulawenforcement.com/?p=9400
6. 6.dlapiperdataprotection.com/?t=law&c=GE
7. 7.ibccs.tax/blog/navigating-the-new-landscape-the-new-law-on-personal-data-protec
8. 8.old.pdps.ge/en/press/post/9457