ISO/IEC 27701 privacy information management in Georgia

What ISO/IEC 27701 covers

ISO/IEC 27701 sets requirements for a privacy information management system (PIMS). The 2025 edition, published in October 2025, is a standalone management system standard: an organisation can now be certified to ISO/IEC 27701 without holding an ISO/IEC 27001 certificate first. Certificates issued against the 2019 edition remain valid during a transition period that runs until October 2028.

The standard contains controls for personal data controllers and for processors. It asks you to know what personal data you hold, why you process it, who receives it, how long you keep it and how you answer requests from data subjects. Privacy risks are assessed and treated with the same discipline as information security risks.

Why Georgian organisations use it

The Law of Georgia on Personal Data Protection, adopted in June 2023 and in force since 1 March 2024, brought Georgian rules much closer to the GDPR. It introduced mandatory data protection officers for banks, insurers, medical institutions and other listed or large-scale processors, data protection impact assessments for high-risk processing, and notification of significant incidents within 72 hours. From March 2026, the supervisory functions previously carried out by the Personal Data Protection Service passed to the State Audit Office of Georgia.

ISO/IEC 27701 does not replace the law, but it gives you a structured way to show that the legal requirements are built into daily work. In Georgia we mostly see three groups of clients:

• Banks, microfinance organisations and insurers that must have a DPO and handle large volumes of customer data.
• IT, outsourcing and BPO companies in Tbilisi and Batumi that process personal data for EU clients and face detailed supplier questionnaires.
• Clinics, laboratories, hotels and online retailers that hold sensitive or high-volume customer data.

What BALTUM does

1. Scoping and gap assessment. We map your processing activities, your role as controller or processor and your existing security controls, then compare them with ISO/IEC 27701:2025 and the Georgian law.
2. Records and risk assessment. We help you build the record of processing activities, a privacy risk assessment and DPIA templates for the processing that needs them.
3. Documentation. Privacy policy, data subject request procedure, retention schedule, incident procedure with the 72-hour notification step, processor agreements and rules for international transfers.
4. Training. Practical sessions for the DPO, HR, customer service and IT staff who handle requests and incidents.
5. Internal audit and management review. We run the internal audit, help close findings and prepare the management review records the auditor will ask for.
6. Audit support. We help you choose an accredited certification body and stay with you through stage 1 and stage 2.

The duration depends on the scope, the number of processing activities and whether an ISO/IEC 27001 system is already in place. We agree a realistic plan after the first assessment.

How certification works

Certification is a two-stage audit by an independent certification body. Stage 1 reviews your documents and readiness, stage 2 checks that the system works in practice. The certificate is valid for three years, with surveillance audits in the second and third years. Choose a body accredited by an IAF MLA signatory for this scheme and check the certificate in IAF CertSearch. If you already hold ISO/IEC 27001, the two audits can usually be combined to save auditor days.

Related standards and reading

ISO/IEC 27701 works well on top of ISO/IEC 27001. Companies serving EU customers often combine it with a GDPR compliance programme. For a closer comparison of the Georgian law and the standard, read how to align the Georgian personal data law with ISO 27701.

To discuss your scope, send a short description of your organisation and the personal data you process through the request form or to info@baltum.org. We will reply with proposed next steps.

Frequently asked questions

Do we need ISO/IEC 27001 before ISO/IEC 27701?

Not any more. ISO/IEC 27701:2025 can be certified on its own. Many organisations still combine the two, because privacy controls rely on the same access, logging, backup and supplier controls that ISO/IEC 27001 covers.

Does an ISO/IEC 27701 certificate prove compliance with the Georgian law?

No certificate confirms legal compliance. The State Audit Office assesses compliance with the Law on Personal Data Protection. A certified PIMS is strong evidence that you manage personal data systematically, and it makes regulator inspections and client audits easier to handle.

We hold an ISO/IEC 27701:2019 certificate. What happens now?

It stays valid during the transition period that ends in October 2028. We review the gaps against the 2025 edition and help you plan the transition audit together with a surveillance or recertification audit.

Is a data protection officer mandatory for our company?

The law requires a DPO for public institutions, banks, insurers, microfinance organisations, medical institutions and several other listed sectors, and for large-scale processing or systematic monitoring. We check your situation during the gap assessment.