Under the Law of Georgia on Personal Data Protection, the appointment of a Data Protection Officer (DPO) is mandatory for controllers and processors that fall within certain categories, including public authorities, insurance organizations, banks, microfinance institutions, credit bureaus, electronic communications companies, airlines, airports, medical institutions, or any controller/processor that processes large volumes of personal data or systematically monitors the behavior of data subjects.¹

The DPO is responsible for advising and informing the controller or processor and their employees on compliance with data protection requirements and regulatory developments. They participate in drafting internal policies, procedures, and Data Protection Impact Assessments, and monitor their implementation. The DPO also analyses and provides recommendations on data subject requests and complaints, represents the controller or processor in communications with the State Audit Office of Georgia, and coordinates the provision of information and documentation requested by the authority. Furthermore, the DPO informs data subjects about the processing of their personal data and their rights and may perform other functions aimed at enhancing data protection standards within the organization.²

The DPO may be an internal employee or an external service provider, provided there is no conflict of interest. Controllers and processors may appoint a single DPO jointly for multiple entities if this ensures the effective performance of the DPO's functions.³

DPOs must possess adequate knowledge in the field of data protection. They report to the highest management level appropriate to their organization and must be provided with sufficient resources and independence to fulfil their duties.⁴

The identity and contact details of the DPO must be communicated to the State Audit Office of Georgia within 10 working days of appointment, designation, or replacement, and should be proactively published on the controller's or processor's website (if available) or otherwise made publicly accessible. Temporary absences or termination of the DPO must be immediately addressed by appointing another qualified person.⁵

The General Auditor determines the scope of controllers and processors that are not required to appoint a DPO through a normative act.⁶