IT Security: Obligations in Georgia

Published on April 26, 2026 and written by Cyril Jarnias

In an increasingly digital world, cybersecurity has become an unavoidable priority, and Georgia is no exception to this pressing reality. With the rise of information technologies, the country has implemented strict regulations to ensure the protection of data and systems. In Georgia, various organizations, whether public or private, face specific legal obligations to prevent cyberattacks and protect information. This article explores in depth the standards and legal requirements for cybersecurity, offering an overview of the strategies adopted by Georgia to secure its cyberspace and ensuring that any entity operating within its borders complies with these crucial guidelines.

Overview of Cybersecurity Standards in Georgia

Key Cybersecurity Laws and Regulations

Georgia has strengthened its legal framework for cybersecurity with the Cybersecurity Law, adopted in 2021. This law defines the obligations of public and private entities regarding the protection of critical infrastructure. It builds on earlier legislation such as the Law on Electronic Communications (2005) and the Law on Personal Data Protection (2011), which is aligned with the European GDPR.

Involved Bodies

The Georgian Cybersecurity Center (CERT-GE), under the authority of the Ministry of Defense, plays a central role in overseeing cyber incidents. The Data Exchange Agency (DEA), attached to the Ministry of Economy, is responsible for implementing public policies. NGOs like the Internet Development Initiative (IDI) participate in awareness and training efforts.

Alignment with International Standards

Georgia has acceded to the Budapest Convention on cybercrime and collaborates with NATO and the EU to harmonize its practices. The country has also adopted ISO 27001 standards for information security management in the public sector.

Local Initiatives for Cyber Resilience

Campaigns like “Stay Safe Online” aim to educate citizens and businesses. In 2023, the government launched a grant program to help SMEs protect themselves against cyberattacks.

Recent Examples of Measures

In response to the increase in ransomware attacks, Georgia has implemented a mandatory reporting system for major incidents. CERT-GE has also organized simulation exercises with international partners to test responses to cyber crises.

Compliance with Data Protection Requirements

Georgian Data Protection Laws and Regulations

Georgia governs data protection primarily through the Law on Personal Data Protection, which came into effect in 2012. This law partially aligns with the EU GDPR and defines principles of lawfulness, purpose, and data minimization. Other texts, such as the Law on Electronic Communications, complement this framework.

Regulatory Bodies

The General Inspector for Personal Data Protection is the independent authority responsible for overseeing compliance. This body investigates complaints, imposes sanctions, and publishes guidelines for businesses.

General Framework for Data Processing

Personal data must be processed transparently, with explicit consent from individuals, except in legally defined cases. Storage is limited to the necessary duration, and businesses must ensure technical and organizational security measures.

Individual Rights

Georgian citizens have the right to access, rectify, and delete their data. They can also object to its processing or request its portability, in accordance with the law.

Breach Notification Obligations

Businesses must notify the General Inspector and affected individuals within 72 hours of discovering a data breach, if it poses a risk to the rights and freedoms of individuals.

Penalties for Non-Compliance

Fines can reach 10,000 GEL (approximately 3,700 USD) for serious violations. Additional administrative or criminal penalties, such as suspension of operations, may also apply.

Recent High-Profile Cases

In 2022, a Georgian bank was fined for failing to secure its customers’ data, leading to a leak. Conversely, a telecommunications company was praised for its proactive compliance following an audit by the General Inspector.

Measures to Ensure Cybersecurity in Georgia

Legal Obligations for Cybersecurity in Georgia

Georgia has adopted several laws to regulate cybersecurity, including the Cybersecurity Law (2019) and the Law on Personal Data Protection (2011). These texts impose on businesses and public institutions measures for protecting information systems, notifying data breaches, and complying with international standards. Critical infrastructure must undergo regular audits and have incident response plans.

Protection of Critical Infrastructure and Networks

The Georgian government has established a national cybersecurity strategy to secure vital sectors (energy, transportation, healthcare). The Georgian Cybersecurity Center (CERT-GOV-GE) oversees threat detection and response, while strict technical standards are applied to essential operators.

Training and Awareness

Training programs are provided to businesses and individuals through public campaigns and partnerships with universities. Simulated attack exercises are organized to strengthen preparedness. SMEs benefit from practical guides to improve their resilience.

International Collaborations

Georgia collaborates with NATO, the European Union, and organizations like ENISA to harmonize its standards. It also participates in regional initiatives, such as the Cybersecurity Partnership with the United States, to share best practices and advanced technologies.

Technologies and Preventive Measures

The country deploys encryption solutions, intrusion detection systems, and firewalls to protect sensitive data. Authorities encourage the adoption of multi-factor authentication and regular software updates. Penalties for non-compliance can include fines or restrictions on access to public networks.