Data protection & privacy law in Georgia (2026)

The Personal Data Protection Service ceased to exist and all its functions — complaints, inspections, covert-surveillance oversight, and fining authority — transferred to the State Audit Office of Georgia (SAO). Civil-society groups warned that embedding data-protection oversight inside a general audit body risks undermining the independence required by international standards.

Law No. 1289 amended the Personal Data Protection Law to add new permissible grounds for processing sensitive personal data (Article 6) and biometric data (Article 9), mirroring GDPR Article 9 exemptions. The amendments became effective on March 2, 2026 alongside the SAO transfer.

The Constitutional Court ruled that the Ministry of Internal Affairs' direct, unrestricted access to telecommunications networks was unconstitutional, finding that existing oversight mechanisms were insufficiently robust against unjustified interference with privacy. The court also invalidated blanket metadata-retention rules and ordered corrective legislation by March 31, 2017.

A mandatory dual-authorization regime for telecommunications interception took effect: both the security service and the Personal Data Protection Inspector's Office were required to approve each covert intercept, giving the Inspector an active gatekeeping role. The reform responded to sustained civil-society pressure over mass-surveillance concerns revealed in prior years.

Georgia established its first dedicated data-protection supervisory authority. The Inspector was empowered to receive and investigate data-subject complaints, conduct on-site inspections of controllers, issue binding recommendations, and — uniquely — oversee the legality of covert investigative actions by law enforcement and intelligence agencies.

Parliament adopted Law No. 5669-RS 'On Personal Data Protection', Georgia's first comprehensive statutory framework for privacy. It established core principles (purpose limitation, data minimisation, consent), created rights for data subjects to access and correct their data, and imposed obligations on data controllers — forming the legal foundation that remained in place for over twelve years.