Under Georgian law, the processing of personal data for direct marketing purposes is generally only permitted with the data subject’s explicit consent.¹ Consent must be obtained prior to processing, and data subjects must be informed clearly and understandably of their right to withdraw consent at any time, as well as the mechanism to exercise this right.²

Controllers and processors must promptly stop direct marketing upon a data subject’s withdrawal of consent, generally within 7 working days, and ensure that the withdrawal can be exercised using the same means as the marketing communication or other accessible method.³ The process must be simple, free of charge, and accompanied by clear instructions. Controllers or processors bear the burden of demonstrating that consent was obtained and that withdrawal mechanisms are adequate, and they must keep records of consent and withdrawal for the duration of marketing activities and one year thereafter.⁴