2025-06-30

The President of the Personal Data Protection Service, Dr. Dr. Lela Janashvili Presented the 2024 Activity Report to the Parliament

---

The President of the Personal Data Protection Service, Dr. Dr. Lela Janashvili, presented the 2024 activity report at a joint session of the Parliament’s Human Rights and Civil Integration, Defense and Security, and Legal Affairs Committees.

The report includes information on the state of personal data protection in Georgia, the conduct of covert investigative actions, and the oversight of activities carried out in the Central Bank of Electronic Communication Identification Data.

“2024 was a landmark year for the development of Georgian personal data law. The Law “On Personal Data Protection”, adopted by the Parliament of Georgia in June 2023, entered into force on March 1, 2024, and was fully implemented by June 1.

The law, which aims to protect the fundamental rights and freedoms of individuals in the processing of personal data—including the rights to private and family life, private space, and communication—provides appropriate guarantees for the effective protection of the data subject’s rights and freedoms. It also equips the independent supervisory authority for personal data protection with the mechanisms and powers necessary to perform its functions. Most importantly, it fully reflects the principles and values of the General Data Protection Regulation (GDPR),” stated Dr. Dr. Lela Janashvili.

It is worth noting that, according to last year’s statistical data, both the number of citizen appeals to the Service and the number of inspections carried out increased.

During the reporting period, the Service received a total of 1,662 applications/notifications, of which 52% (863) were applications and 48% (799) were notifications. Of these, 90% (1,486) concerned data processing by private sector organizations, 8% (140) by public institutions, and 2% (36) by law enforcement bodies.

In 2024, the Service conducted inspections of the lawfulness of data processing in 265 cases. Of these, 31% (83) were planned inspections and 69% (182) were unplanned.

During the reporting period, the Service identified 508 instances of unlawful processing of personal data.

In total, 794 instructions and recommendations were issued.

The Service received 11 notifications of data security breaches (incidents) from data controllers during the reporting period.

Additionally, the Service provided 16,462 consultations.

The Personal Data Protection Service activated the suspension mechanism for covert wiretapping and recording of telephone communications (through the electronic control system) in 92 cases.

To raise awareness about personal data protection, the Service systematically conducted public lectures, informational meetings, and trainings for representatives of both the private and public sectors, including law enforcement bodies.

In 2024, the Service held 108 meetings, attended by 6,522 participants, including both data subjects and data controllers/processors.

In her speech, Dr. Dr. Lela Janashvili also discussed the 2025–2028 Activity Strategy, which was developed in the previous year based on an analysis of international legal standards, modern trends, and the Service’s operational experience. The main priorities of the strategy include strengthening oversight of the lawfulness of personal data processing and ensuring timely and effective responses to unlawful processing, enhancing the culture and awareness of data protection in society, and improving the use of preventive mechanisms. Additionally, the strategy emphasizes the continuous institutional development of the Personal Data Protection Service, including expanding cooperation with data protection supervisory authorities in EU Member States and beyond, as well as with EU sectoral institutions and international organizations—aiming to integrate international best practices into the Service’s operations.

At the conclusion of her report, the President of the Service expressed her gratitude to the employees of the Personal Data Protection Service for their work.