Under Georgian law, the transfer of personal data to another country or international organization is allowed only if specific conditions are met. Transfers are permissible when they comply with the requirements established by the law and adequate safeguards for data protection and the rights of the data subject are ensured in the recipient country or organization.¹

Transfers are also permitted if:

• the transfer is provided for under an international treaty or agreement to which Georgia is a party;
• the data controller ensures adequate safeguards through a contract with the recipient state, legal entity, individual, or international organization;
• the transfer is required under applicable laws, including the Criminal Procedure Code, the Law on Legal Status of Aliens and Stateless Persons, the Law on International Cooperation in the Field of Criminal Law, the Organic Law on the National Bank of Georgia, or the Law on the Prevention of Money Laundering and Terrorism Financing;
• the data subject provides written consent after being informed of the absence of adequate safeguards;
• the transfer is necessary to protect the vital interests of the data subject who cannot provide consent; or
• the transfer is necessary and proportionate to safeguard a significant public interest.²

When transferring data under these legal grounds, the controller must implement appropriate organizational and technical measures to ensure secure transfers. Transfers based on contractual safeguards require enforceable terms. Subsequent transfers to a third party are allowed only if compatible with the original purposes and in accordance with the law and safeguards.³

The existence of adequate safeguards in a recipient state or international organization is assessed by the State Audit Office based on international obligations, data subject rights and freedoms, applicable regulatory requirements, the rules for further international transfers, and the presence and powers of an independent supervisory authority. Lists of states and organizations with adequate safeguards are determined and updated by normative acts of the State Audit Office.⁴