Georgia's personal data law and ISO 27701: how to align

The Law of Georgia on Personal Data Protection sets the legal obligations. ISO/IEC 27701 gives you a management system to meet them and prove it. Used together, they avoid two parallel compliance projects.

The law in brief

Parliament adopted the current Law of Georgia on Personal Data Protection on 14 June 2023. Most of it applied from 1 March 2024, and the provisions on data protection officers from 1 June 2024. The law moved Georgian rules much closer to the GDPR: clearer legal bases, stronger data subject rights, incident notification, impact assessments and mandatory data protection officers for certain organisations.

Supervision has also changed. Under amendments adopted at the end of 2025, the functions of the Personal Data Protection Service passed to the State Audit Office of Georgia in March 2026. Notifications, DPO registrations and complaints now go there. Check current guidance from the State Audit Office before relying on older templates or forms.

Obligations that need a process, not a policy

• Data protection officer. Mandatory for public institutions, commercial banks, insurers, microfinance organisations, credit bureaus, electronic communications companies, airlines, airports and medical institutions, and for organisations processing data of a large number of people or carrying out systematic monitoring. The DPO's details must be reported to the supervisory authority within 10 working days of appointment or change.
• Incident handling. Controllers must record every personal data incident and notify the supervisory authority within 72 hours of becoming aware of it, unless the incident is unlikely to cause significant harm. Processors must inform the controller immediately. Where the risk is high, the people affected must also be informed.
• Impact assessments. High-risk processing needs a documented assessment before it starts.
• Foreign controllers. A controller or processor outside Georgia that uses technical means in Georgia may need to appoint and register a special representative, with exemptions for EU and EEA entities and for countries recognised as adequate.
• International transfers. Allowed to countries or organisations with adequate safeguards, or on other grounds set out in the law, such as contractual safeguards.
• Data subject rights. Access, rectification, erasure, restriction, objection and portability all need someone responsible, a channel and response records.

Where ISO/IEC 27701 fits

ISO/IEC 27701:2025 is a standalone standard for a privacy information management system (PIMS). Earlier editions could only be certified as an extension to ISO/IEC 27001; the 2025 edition can be implemented on its own, although many organisations still combine it with an existing ISMS. Certificates issued against the 2019 edition must transition by October 2028.

The standard is not Georgian law, and certification does not mean the supervisory authority has approved you. Its value is that it forces the work the law implies to be organised, assigned, measured and audited every year.

Mapping the law to the management system

1. Inventory first. Build a record of processing activities: purposes, legal bases, categories of data and data subjects, recipients, transfers and retention. Georgian law does not impose a general registration duty, but you cannot answer an inspector or a data subject without this record. ISO/IEC 27701 expects it.
2. Roles. Decide where you are a controller and where a processor. A Tbilisi payroll provider is usually a processor for its clients and a controller for its own staff. The PIMS controls differ for each role.
3. Risk assessment. Extend your information security risk assessment to privacy risks to individuals, and use it to decide when an impact assessment is required.
4. Incident procedure. One procedure for security incidents and personal data incidents, with a clock that starts when you become aware and a decision step on notifying the State Audit Office within 72 hours.
5. Supplier and transfer controls. Contract clauses for processors, a list of transfers outside Georgia and the ground used for each.
6. DPO and accountability. The DPO's role, independence and reporting line documented; management review covering privacy results.
7. Evidence. Training records, access reviews, responses to data subject requests and audit results give you something to show both the certification body and the regulator.

If you also serve EU clients

Many Georgian IT and outsourcing firms process data of EU residents. The GDPR then applies to that processing alongside Georgian law. A single PIMS can cover both, with the legal register listing both regimes. See our GDPR page for what EU clients usually ask for in contracts and audits.

How BALTUM helps

We start with a gap assessment against the Georgian law and ISO/IEC 27701, build the record of processing, set up the incident and data subject request procedures, train the DPO and staff, and run an internal audit before certification by an accredited body. The scope and duration are set after the first assessment. Details are on our ISO 27701 page.

This article is general information, not legal advice. For an assessment of your organisation, use the form on this site or write to info@baltum.org.

Frequently asked questions

Who supervises personal data protection in Georgia in 2026?

Since March 2026 the State Audit Office of Georgia performs the functions of the former Personal Data Protection Service, including handling incident notifications and DPO registrations.

Does ISO 27701 certification prove compliance with Georgian law?

No. It shows that you run an audited privacy management system. Compliance with the law is a separate legal question, but the system produces most of the evidence a regulator would ask for.

Can ISO 27701 be certified without ISO 27001?

Yes. The 2025 edition is a standalone standard. Organisations that already hold ISO 27001 often combine the two to reuse risk management and controls.

More articles from BALTUM Georgia