The Law of Georgia on Personal Data Protection provides a comprehensive set of definitions that largely correspond to internationally recognised data protection terminology and are broadly aligned with the concepts used in the GDPR.

Under the law, personal data is defined as any information relating to an identified or identifiable natural person. A natural person is considered identifiable if they can be identified directly or indirectly, including by reference to identifiers such as name, identification number, geolocation data, electronic communication identifiers, or factors specific to the physical, physiological, psychological, genetic, economic, cultural, or social identity of that person.

The law also defines special categories of personal data, which include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, data concerning a person’s sex life, as well as genetic and biometric data processed for the purpose of uniquely identifying an individual. Certain information related to criminal proceedings, convictions, and victim status is also treated as a special category of data.

Processing of personal data is broadly defined as any operation performed on personal data, whether or not by automated means. This includes collection, recording, organisation, storage, alteration, retrieval, use, disclosure (including transfer or publication), restriction, erasure, or destruction of data. The law further distinguishes between automated, non-automated, and partially automated processing.

Similar to the GDPR framework, the law recognises the roles of data controller, joint controllers, and data processor. A controller is the natural or legal person, or public authority, that determines the purposes and means of processing personal data, while a processor processes personal data on behalf of the controller.

Additional key concepts defined by the law include data subject, consent of the data subject, recipient, third party, data protection officer, and special representative (designated by controllers or processors established outside Georgia). The legislation also introduces definitions for specific processing activities such as video monitoring, audio monitoring, profiling, pseudonymisation, depersonalisation, direct marketing, and data security incident (data breach).

These definitions establish the conceptual framework for the application and interpretation of the Georgian data protection regime.