The framework
Georgia regulates personal data through the Law on Personal Data Protection (2023), supervised by the Personal Data Protection Service.
For advertisers the consent posture matters most, and Georgia sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Law on Personal Data Protection (2023)
Georgia's 2023 law, in force from mid-2024, moved the country decisively toward the GDPR, adding DPO duties, breach notification and direct marketing rules under an assertive supervisory service.
Marketing and advertising
GDPR-aligned bases; direct marketing requires consent with an easy withdrawal path. Most channel decisions here follow from that consent rule.
Cross-border transfers
Transfers abroad go to destinations on the adequacy list or rely on appropriate safeguards.
Enforcement and penalties
Administrative fines apply, rising for repeat violations. A ceiling means little until the authority uses it, so its docket is the better guide.