Under Georgian law, the data controller is obliged to implement appropriate organizational and technical measures to ensure that personal data is processed in accordance with the law and to demonstrate compliance with these requirements.¹

The controller and the processor must take measures to address potential and incidental risks associated with data processing, including pseudonymization, access logging, and information security mechanisms (confidentiality, integrity, availability), to protect data against loss, unlawful processing, destruction, alteration, disclosure, or misuse.²

When determining the necessary organizational and technical measures, the controller and processor must consider the categories and volume of data, processing purposes, form and means of processing, and potential risks to the data subject’s rights. They must periodically assess the effectiveness of the measures and update or implement additional safeguards if necessary.³

The controller and processor are required to maintain records of all actions performed on electronically stored data, including incidents, collection, modification, access, disclosure (transfer), linking, and deletion. For non-electronic data, records must be kept for all disclosures or alterations, including incident reports.⁴

All personnel involved in processing or with access to data must act within their assigned authority, maintain confidentiality, and protect data, including after the termination of their employment.⁵

The controller and processor must define employee access rights according to their role and implement adequate measures to prevent, detect, and stop unauthorized processing by staff, including raising awareness on data security obligations.⁶