The Law of Georgia on Personal Data Protection does not establish a general obligation for controllers or processors to register their personal data processing activities with the supervisory authority. Instead, the law follows an accountability-based approach, under which controllers and processors are responsible for ensuring compliance with the applicable data protection requirements.¹

However, the legislation provides for a specific registration requirement in certain circumstances. In particular, where a controller or processor registered outside Georgia processes personal data using technical means located in Georgia, it is required to appoint a special representative in Georgia prior to commencing such processing activities.²

The appointed special representative must be registered with the State Audit Office of Georgia in accordance with the procedure established by a normative act issued by the supervisory authority. In such cases, the controller or processor is permitted to process personal data using technical means located in Georgia only after the registration of the special representative.³

The obligation to appoint and register a special representative does not apply to controllers or processors established in Member States of the European Union or in countries recognised by the European Union as providing an adequate level of data protection.⁴