GDPR compliance for companies in Georgia

When the GDPR applies to a Georgian company

The EU General Data Protection Regulation (GDPR) can apply to a company with no office in the EU. Under Article 3(2), it applies when a company outside the EU offers goods or services to people in the EU or monitors their behaviour there. Separately, many Georgian IT, outsourcing and BPO companies process personal data on behalf of EU clients. In that case the EU client remains bound by the GDPR and passes its obligations on to the Georgian processor through a data processing agreement under Article 28.

Georgia does not have an EU adequacy decision. When an EU client sends personal data to a Georgian company, the transfer usually relies on the European Commission's standard contractual clauses and a transfer impact assessment. EU clients will ask you to sign these clauses and to answer questions about your security and about government access to data.

How the Georgian law fits in

The Law of Georgia on Personal Data Protection, adopted in June 2023 and in force since 1 March 2024, follows the GDPR in many areas: legal bases, data subject rights, data protection officers, data protection impact assessments, records of incidents and notification of significant incidents within 72 hours. Since March 2026, supervision has been carried out by the State Audit Office of Georgia, which took over the functions of the Personal Data Protection Service.

There are still differences in definitions, thresholds, transfer rules and procedures, so we do not treat the two laws as identical. Our approach is to build one set of policies and records that meets the stricter requirement on each point, with notes where Georgian or EU rules require something specific.

Who needs this service

• IT and software companies developing or hosting systems for EU clients.
• BPO, contact centre and back-office providers in Tbilisi and Batumi handling EU customer data.
• Online businesses, travel and hospitality companies selling directly to EU residents.
• Georgian subsidiaries of EU groups that must follow group privacy rules.

What BALTUM does

1. Applicability and role analysis. We determine whether the GDPR applies to you directly, as a controller under Article 3(2), or indirectly as a processor, and whether you need an EU representative under Article 27.
2. Data mapping. We build a record of processing activities that covers both the GDPR and the Georgian law.
3. Gap assessment. We compare current practice with both laws and prioritise the gaps.
4. Documentation. Privacy notices, data processing agreements, standard contractual clauses and transfer impact assessments, data subject request procedure, retention schedule, DPIA method and an incident procedure with 72-hour timelines under both laws.
5. Security measures. We check technical and organisational measures against Article 32, often using ISO/IEC 27001 controls as the baseline.
6. Training and DPO support. We train staff and support your DPO or the person responsible for data protection.
7. Client audit support. We help you answer EU client questionnaires and on-site audits.

The duration depends on the number of processing activities, clients and systems. We agree a plan after the first assessment.

Certification and evidence

There is no general "GDPR certificate" that EU clients recognise as proof of compliance. In practice, Georgian companies show their privacy maturity with an ISO/IEC 27701 certificate on top of an ISO/IEC 27001 information security system, together with signed agreements and documented records. For more detail, read how to align the Georgian personal data law with ISO 27701 and ISO 27001 for Georgian IT companies selling abroad.

To discuss your clients and data flows, send a short description through the request form or to info@baltum.org.

Frequently asked questions

We only work for EU clients as a contractor. Does the GDPR apply to us?

Usually you act as a processor. Your EU clients must bind you by contract to GDPR-level obligations, including security, confidentiality, sub-processor approval and incident notification. In practice you must meet those requirements to keep the contracts.

Do we need an EU representative?

Only if the GDPR applies to you directly under Article 3(2), for example because you sell to or monitor people in the EU, and no exemption applies. We assess this case by case.

Does complying with the Georgian law mean we comply with the GDPR?

Not automatically. The two laws are close, but there are differences in scope, thresholds and transfer rules. One combined programme covering both is the practical solution.

Is there a GDPR certificate we can show clients?

There is no widely recognised general GDPR certificate. ISO/IEC 27701 and ISO/IEC 27001 certificates, signed agreements and up-to-date records are the evidence EU clients usually accept.