568 330 318 Free initial consultation · reply within 15 minutes
Administrative law · Personal data

Personal data protection lawyer in Georgia - for people whose data was misused and for companies that must comply

Personal data in Georgia is governed by the Law on Personal Data Protection adopted in 2023 and supervised by an independent regulator, the Personal Data Protection Service. If your data has been collected, disclosed or used unlawfully, you can complain to the Service, go to court and claim compensation. Companies, in turn, must process data only on a lawful basis and be able to prove it with documents.

This page serves two audiences. The first is individuals - including foreigners living or working in Georgia - whose photo, medical details, debt history or address ended up in the wrong hands, who are filmed at work without notice, or who are flooded with marketing calls and texts. The second is businesses: foreign-owned companies, IT firms, online shops and employers who need internal rules, consent forms, a CCTV policy or help with an inspection that has already started.

Updated · Practice area: Administrative law lawyer

Call: 568 330 318 Lawyers for personal data cases
Your rights

Data subject rights in Georgia and how to use them

Every right starts with a written request to the organisation processing your data. A request that is ignored or refused without reason is a solid basis for a complaint.

RightWhat it means in practice
Information and accessFind out what data is held about you, where it came from, why it is used and who it was passed to. You may also request a copy.
RectificationHave inaccurate or outdated data corrected - for example a debt you repaid long ago that still shows as outstanding.
Erasure and restrictionAsk for data to be deleted or for processing to stop when the basis for it has gone or never existed.
Withdrawing consentWhere processing relied on your consent, you can withdraw it at any time. Withdrawal does not undo lawful processing already done, but it stops it going forward.
Objecting to direct marketingRequire marketing calls, texts and e-mails to stop. The company must comply within the period set by law.
Complaint and courtComplain to the Personal Data Protection Service and challenge its decision in court if needed. Compensation is claimed through a separate civil action.
What the lawyer does

Your data was misused - the steps to a complaint and compensation

  1. Securing evidence

    Dated screenshots with links, call logs, text messages, names of people who saw what was published. The lawyer helps you store it so its authenticity cannot easily be challenged later.

  2. A request to the controller

    The lawyer sends a written request asking what data the organisation holds, on what basis and who received it, and demanding that disclosure stops and the data is deleted. Whatever the answer - or the silence - it becomes evidence for the next step.

  3. Complaint to the Service

    A complaint to the Personal Data Protection Service is free. The Service examines whether the processing was lawful and may order the violation to stop, require deletion and fine the controller. The lawyer frames the complaint around facts and specific demands.

  4. Taking part in the review

    During the review the Service asks both sides for explanations. The lawyer answers the controller's arguments - such as "legitimate interest" or "you consented" - which often sound convincing on paper but do not survive scrutiny.

  5. Court and damages

    If the Service's decision does not satisfy you, it can be challenged in court. Compensation, including for non-pecuniary harm, is claimed in a civil action, where a violation already established by the Service is a strong argument.

  6. The criminal route

    Unlawfully obtaining or spreading material about someone's private life can, in some cases, be a crime. The lawyer then also prepares a report to the police or the prosecutor's office and keeps both tracks aligned.

For companies

What the law expects from a business - six areas where inspections begin

Legal basis

Each purpose - contract, legal obligation, consent, legitimate interest - needs its own basis. The lawyer maps your processing activities and finds where a basis is missing.

Consent and transparency

Consent must be freely given, specific and clear, and people must be told who processes their data, why and for how long. A pre-ticked box on a website does not meet that standard.

CCTV

Cameras are allowed for a defined purpose such as security or property protection, with a warning sign. Filming in changing rooms and toilets is prohibited; in workspaces it is allowed only exceptionally and with written notice to staff.

Direct marketing

Marketing messages require the person's consent and an easy way to opt out. Bought databases and "SMS blasts to everyone" are among the most frequent causes of complaints.

Data protection officer

Public bodies and companies named by law - for example banks, insurers and telecom operators, as well as those processing data on a large scale or special categories - must appoint a DPO. The lawyer checks whether your business falls on that list.

Breaches and notification

After a data leak a company must record the incident and, where the law requires, notify the Service and affected people within a short deadline. The response plan should exist before an incident, not be written after it.

Controllers and processors

Who is responsible: controllers, processors and transfers abroad

Georgian law distinguishes two roles. The controller decides why and how data is processed - say, a retailer running a loyalty programme. The processor acts on the controller's instructions - an accounting firm, a call centre, a hosting provider. The main responsibility lies with the controller, but a written agreement with the processor is required, setting out which data it handles, for what purpose and with which safeguards.

Many companies in Georgia, especially foreign-owned ones and IT businesses, keep data on cloud services abroad or share it with a parent company in another country. Such transfers are allowed where the receiving country offers an adequate level of protection or another safeguard recognised by law is in place. The lawyer checks which route fits your case and what the contracts must say.

If your data is held by a state body and the problem is getting its documents or its failure to respond, see the separate page on public information and administrative inaction among the related services below.

Typical situations

Four situations people bring to a data protection lawyer

Debt collectors calling relatives and the employer

A collection agency phones a borrower's sister, neighbours and boss to discuss the debt. The lawyer files a complaint with the Service about disclosure to third parties and demands that the calls stop.

Cameras with sound in the office

An employer installs cameras that also record audio in work rooms, without warning staff. The lawyer assesses whether the purpose and scope are proportionate and complains to the Service on the employee's behalf.

A clinic disclosed a diagnosis

Health data is a special category, so disclosing it is judged more strictly. The lawyer combines a complaint to the Service with a claim for non-pecuniary damages against the clinic.

An online shop under inspection

A foreign-owned e-commerce company receives notice of an inspection. The lawyer quickly prepares a description of the processing, consent forms and a privacy policy in Georgian, and fixes gaps before the inspection ends.

Mistakes

Mistakes that weaken your position - on either side

  • Going straight to court without preserving evidence or first writing to the controller.
  • Arguing publicly under the offending post, which spreads the information to even more people.
  • Publishing a privacy policy copied from another country's template that does not describe what the company actually does.
  • Relying on consent where another legal basis fits better, and then facing a problem when the person withdraws it.
  • Installing cameras without a sign, a stated purpose and a retention period for the recordings.
  • Hiding a breach in the hope nobody notices - late notification can be treated as a separate violation.
Preparation

What to prepare for the first meeting with a data protection lawyer

  • A short timeline: when and how you learned of the violation and who the controller is.
  • Screenshots, call history, letters, and any contract or consent form you signed.
  • The controller's reply to your request, if you have already contacted them.
  • For companies: a list of the data you process, your current policy, a CCTV plan and contracts with service providers.
  • Any letter from the Service or notice of an inspection.
  • Whether data is stored or transferred abroad - for example on a foreign cloud service.

FAQ: personal data protection in Georgia

Where do I complain if my personal data was disclosed unlawfully in Georgia?

To the Personal Data Protection Service - the complaint is free and can be filed without a lawyer. Compensation requires a civil claim in court, and the unlawful spreading of private-life material may also open the criminal route.

Can my employer install cameras at work?

Yes, for security or property protection, with a warning sign and notice to employees. Constant monitoring of the workspace is allowed only exceptionally, and never in changing rooms or toilets.

A bank or debt collector keeps calling my relatives. Is that legal?

Disclosing information about a debt to third parties is, as a rule, not allowed. Keep a record of the calls and complain to the Service; the lawyer will assess whether a damages claim is also worthwhile.

Does Georgian data law apply to a foreign company?

It applies to processing carried out in Georgia, so a foreign company with a branch, subsidiary or staff here is generally covered. Where it applies to a business with no presence in Georgia depends on the specific facts, and the lawyer should assess it.

Does our company need a data protection officer?

It depends on the sector and the scale of processing: the law requires certain categories to appoint one, while for others it is simply good practice. A lawyer can tell quickly from a description of your business.

What can the Service do once it finds a violation?

It may order the controller to stop processing, delete or correct data and impose an administrative penalty. The Service does not award compensation - that needs a civil court.

Can the same lawyer handle both the complaint and the damages claim?

Yes, and it often works better: a lawyer who handled the complaint already knows the evidence and can use the Service's decision effectively in the claim. For administrative and civil matters you need a lawyer with a general or civil licence.

Lawyers for personal data cases

The list includes 4746 lawyers who can represent clients in administrative matters. Hands-on data protection experience is not visible on every profile, so the coordinator will, within 15 minutes, help you choose a lawyer who works on company compliance or individual complaints, including in English.

All lawyers in this area (4 746) →

Other administrative law services

Public information and inactionDamages from the stateFines and offence reportsLicences and permits Administrative law lawyer →

Data in the wrong hands, or an inspection coming?

Call us and within 15 minutes the coordinator will connect you with a lawyer who can tell you which route to take - a complaint, a lawsuit or putting your internal rules in order. The first consultation booked via Coalition Legal is free.

Call: 568 330 318 Fill in the form
Call: 568 330 318