Core Legal Practice
We help companies and organizations assess and meet the requirements of personal data protection legislation. The service covers legal analysis of data processing activities, preparation of the required documentation, risk assessment and the establishment of internal data protection procedures.
Our aim is for the organization to have a clear legal basis for processing data, appropriate internal rules and practical procedures that match its activities and the applicable legal requirements.
As part of the service, we review the relevant legal requirements, including:
Depending on the organization's activities, the service may include:
As a result of the assessment, the organization receives information on the issues identified and possible ways to address them. Where needed, legal support is also available while the recommendations are implemented.
In cases provided for by law, an organization may be required to appoint a Data Protection Officer. In other cases, the need for an officer or related advisory services may be determined by the organization's activities and the scale of its data processing.
The scope and format of the service are determined according to the organization's needs and the requirements of the law.
Data Protection Officer services may include:
Depending on the organization's activities and data processing, you may need:
The final list of documents is determined after assessing the organization's activities, the purposes of data processing and the requirements set by law.
If your organization transfers personal data to a partner, service provider or other recipient located abroad, it is important to assess the legal basis for the transfer and the appropriate safeguards.
The service may include:
In the event of an incident involving personal data, it is important to respond promptly, assess the risks and determine the obligations set by law.
Legal support may include:
For a specific incident, the scope of the response is determined by the factual circumstances and the applicable legislation.
The exact scope, stages and cost of the service are determined according to the organization's needs and the volume of work.
Personal Data Protection
When must an organization in Georgia appoint a Data Protection Officer? Legal grounds, who is covered, the DPO’s role and the risks of non-compliance.
No. Whether a Data Protection Officer must be appointed depends on the circumstances set out in the Law of Georgia "On Personal Data Protection". The organization's activities and the nature and scale of its data processing need to be assessed to determine whether this obligation applies to it.
A small business should also assess its personal data processing and the legal requirements that apply to it. The documentation and procedures needed depend on the nature of the business and the circumstances of the data processing. Being a small business does not by itself mean that data protection obligations do not exist.
An audit assesses existing processes and documentation, identifies gaps and develops recommendations. Preparing a policy means creating a specific document. In practice, to draft effective documentation it is advisable to study the organization's actual processes first.
Yes. We can assess the legal basis for an international data transfer, the appropriate safeguards and the documentation required. The specific procedure depends on the circumstances of the transfer and the applicable legal requirements.
Yes. A one-off legal consultation on a specific issue, a review of documentation or an assessment of a data processing activity is possible. Where needed, broader or ongoing legal support can also be agreed.
Do you need data protection documentation, an assessment of your existing processes or Data Protection Officer services? Tell us about your organization and its needs so we can determine the appropriate scope of legal support.