Mandatory Data Protection Officers (DPOs) in Georgia: When Appointment Is Required

In short

A DPO is mandatory for public institutions, certain regulated sectors such as banks, insurers, telecoms, airlines and medical institutions, and organizations that carry out large-scale systematic monitoring or large-scale processing of special categories of data. The test is the nature of the processing, not the size of the organization.

The protection of personal data has become an increasingly important part of regulatory compliance for organizations operating in Georgia. The Law of Georgia on Personal Data Protection imposes a range of obligations on data controllers and processors to ensure that personal data is processed lawfully and securely.

One of the key compliance mechanisms under this framework is the appointment of a Data Protection Officer (DPO). In certain circumstances, organizations must designate a DPO to oversee compliance with data protection obligations and to act as a contact point for the supervisory authority and for data subjects.

This article explains when the appointment of a DPO is mandatory under Georgian law and outlines the key functions of the role.

Legal Framework and Supervisory Authority

The appointment and functions of Data Protection Officers in Georgia are regulated primarily by:

• the Law of Georgia on Personal Data Protection (adopted in 2023 and in force since 1 March 2024); and
• relevant secondary legislation and guidance issued by the Personal Data Protection Service of Georgia.

The Personal Data Protection Service of Georgia acts as the supervisory authority. It monitors compliance with data protection requirements and may issue recommendations or impose sanctions for violations.

Purpose of the Data Protection Officer

A DPO serves as an internal compliance and oversight mechanism. Its primary purpose is to help the organization comply with personal data protection requirements and to minimize the legal and operational risks of data processing. The DPO also acts as the point of contact between the organization, data subjects and the supervisory authority.

Key Functions of a DPO

The tasks of a DPO typically include:

• informing and advising the organization and its staff on their data protection obligations;
• monitoring compliance with the law and with the organization’s internal data protection policies;
• advising on data protection impact assessments for high-risk processing;
• raising awareness and training the staff involved in data processing;
• handling inquiries and requests from data subjects; and
• acting as the contact point for the Personal Data Protection Service and cooperating with it.

The exact scope of the role is set by law and should be reflected in the DPO’s appointment documents or service agreement.

When Is the Appointment of a DPO Mandatory?

The appointment of a DPO is mandatory in cases where the nature, scale or risks of data processing call for enhanced compliance oversight. In particular, a DPO is required where:

• a public institution or public authority processes personal data;
• an insurance organization, commercial bank, microfinance organization, credit bureau, electronic communication company, airline, airport or medical institution processes personal data;
• the organization carries out large-scale systematic monitoring of individuals; or
• the organization’s core activities involve large-scale processing of special categories of personal data.

The obligation depends on the characteristics of the processing activities, not solely on the size of the organization.

Special Categories of Personal Data

The requirement is particularly relevant where an organization processes sensitive or special categories of personal data, including:

• health-related information;
• biometric or genetic data;
• data relating to criminal convictions or offenses; and
• information revealing racial or ethnic origin, political opinions, religious beliefs or trade union membership.

Organizations that process such data on a large scale are generally subject to stricter compliance obligations under Georgian law.

Position and Independence of the DPO

The DPO must be able to perform their functions independently and without conflicts of interest. Organizations are generally expected to ensure that the DPO:

1. has appropriate professional qualifications and knowledge of data protection law;
2. is involved in data protection matters in a timely manner; and
3. has access to the necessary resources and information.

The DPO may be an employee of the organization or an external service provider, depending on its structure and operational needs.

Liability and Compliance Risks

Failure to appoint a DPO where the law requires one may lead to legal and regulatory consequences, including administrative fines or sanctions, increased regulatory scrutiny, and reputational and operational risks. Appointing a qualified DPO is therefore an important compliance safeguard for any organization that processes personal data.

Conclusion

The DPO is an important component of Georgia’s personal data protection framework. Organizations engaged in high-risk or large-scale processing must carefully assess whether the law requires them to appoint a DPO and ensure that the appointee can fulfill the role effectively. By putting appropriate internal oversight in place and complying with data protection requirements, organizations can reduce legal risks, strengthen accountability and build trust in their data processing practices.

Frequently Asked Questions

Does a small company need a DPO?

Not automatically. The obligation depends on the nature of the organization and its processing, not on its size. A small bank-type institution or a small clinic may be covered, while a small business with limited, low-risk processing generally is not.

Can the DPO be an external provider?

Yes. The DPO may be an employee or an external service provider, as long as the role can be performed independently and without a conflict of interest.

Can a company director or IT manager also act as DPO?

This is generally not advisable. A person who decides the purposes and means of processing may have a conflict of interest, which undermines the independence of the role.

Need Help With DPO Compliance?

Not sure whether your organization is required to appoint a Data Protection Officer under Georgian law? Our specialists can assess your data processing activities and guide you through your compliance obligations. Contact SB legal solution for a professional consultation.

This article provides general information and does not constitute individualized legal advice. Laws, tariffs and procedures may change; confirm the current requirements before acting.