Many websites and business applications send personal data abroad without their owners noticing: through hosting, content delivery networks, web analytics, CAPTCHAs or email services. Under Georgia’s Law on Personal Data Protection, such a transfer can require a permit from the supervisory authority. This article explains when that is the case – and how to avoid it.
What counts as a transfer
The law applies to personal data processed in Georgia. A transfer is any case in which data leaves Georgia for another state or for an organisation registered abroad. The seat of the recipient counts, not only the location of its servers: a data center of a foreign provider in Tbilisi does not change who receives the data.
An IP address is personal data. As soon as a website or an app makes the browser connect to a server abroad, that server learns the visitor’s IP address – and the data has been transferred. The supervisory authority decided exactly that in a published case: a ride-hailing app connected to servers in another country, which thereby received the IP addresses of the devices. The authority refused the permit applied for, imposed a fine and ordered the transfer to stop.
Countries on the list: no permit needed
A transfer is allowed without further steps if the recipient state provides appropriate safeguards for data protection (Article 37(1)). Which states these are is decided by the supervisory authority – since 2 March 2026 the State Audit Office – in a list. The current list (Order No. 007 of 14 April 2026) names 49 states, among them all EU member states, Norway, Iceland, Liechtenstein, Switzerland and the United Kingdom, as well as Canada, Japan, Israel and the Republic of Korea.
The United States are not on the list – nor are Turkey, Russia, the United Arab Emirates, Singapore or India, for example.
Other countries: contract and permit
For a state that is not on the list, the usual route is a contract with the recipient that creates appropriate safeguards. Such a transfer is only allowed after a permit from the State Audit Office (Article 37(2) and (3)). The procedure (Order No. 012 of 18 May 2026) requires, among other things:
- an application in Georgian, with notarised translations of all documents in other languages,
- the contract with the recipient,
- current registry extracts of both parties – the recipient’s from its own state, at most one month old.
The authority decides within up to three months. Until the permit is granted, no data may be transferred.
Why consent rarely helps
The law also allows a transfer based on the written consent of the person concerned, after information about the missing safeguards and the risks. The authority, however, treats consent as an exception: in a published case it declared a bank’s transfer to its parent company unlawful, although the customers had consented – the bank should first have sought a contract and a permit.
For a website, consent comes too late anyway: the first request reaches the server abroad before a visitor can click anything.
What a violation costs
A transfer in breach of Article 37 leads to a warning or a fine of 2,000 lari – 4,000 lari for companies with an annual turnover above 500,000 lari or in aggravating circumstances (Article 85). In addition, the authority can order the transfer to stop. For a website that runs through a foreign delivery network, that means switching it off.
Where data leaves the country unnoticed
- hosting, content delivery networks and DDoS protection
- web analytics and tag managers
- CAPTCHAs and form services
- fonts, scripts and maps loaded from third-party servers
- email, newsletter and chat services
- backups and cloud storage
For each of them, check who the contracting party is, where it is registered and where it processes the data.
How we handle it
The servers of epicsoft networks are in Finland and Germany – both on the list. Our website loads nothing from outside providers; visitor statistics and spam protection for forms run on our own server (how our form protection works). Hosting with us therefore needs no permit for the transfer.
This article summarises the legal situation as of October 2026 for general information. It is not legal advice. The law: Law of Georgia on Personal Data Protection.