Under Georgian law, the data controller is required to record any data incident, its consequences, and the measures taken, and must notify the State Audit Office in writing or electronically no later than 72 hours after becoming aware of the incident, except when it is unlikely that the incident will cause significant harm or pose a substantial risk to the rights and freedoms of individuals.¹

The processor must immediately inform the data controller of any incident.²

The notification must include:

• the circumstances, nature, and timing of the incident;
• the categories and approximate number of personal data affected, as well as the categories and approximate number of data subjects potentially impacted;
• the likely consequences of the incident and measures taken or planned to mitigate or eliminate its effects;
• whether the data controller intends to notify the data subject(s) under Article 30 and within what timeframe; and
• contact details of the Data Protection Officer or other relevant contact person.³

If it is not possible to provide all the information at once, the controller may provide the information in stages within a reasonable period, in agreement with the State Audit Office.⁴

If the data controller fails or is unable to inform the data subject(s), the State Audit Office may publicize information about the incident based on the circumstances, potential harm, or number of affected data subjects, except where specific conditions in Article 30(3) apply.⁵

This rule does not apply if the notification includes a statement from a public or private entity that public disclosure of the incident would endanger:

• state security, information or cyber security, or defense interests;
• public safety;
• crime prevention, investigation, prosecution, enforcement of imprisonment or other sanctions, or operational-search activities; or
• significant financial, economic, public health, or social protection interests of the country.⁶

The State Audit Office may refrain from publicizing information even if the notification does not include the above statement.⁷

Entities required to provide notification must specify relevant circumstances in accordance with their competence or scope of activity. Critical information systems must indicate information and cyber security grounds in coordination with the competent authorities.⁸