Video surveillance in Georgia: what the law expects of a business

Which law applies

Video surveillance is governed by the Law of Georgia “On Personal Data Protection”. The new law has been in force since 1 March 2024 and replaced the old one. The regulator is the Personal Data Protection Service of Georgia (personaldata.ge); the official text is in the Legislative Herald (matsne.gov.ge).

The camera owner is the data controller

An image from which a person can be identified is personal data. The company or sole trader who decides where a camera goes, what it shows, who watches and how long recordings are kept is, in the law's terms, the data controller — and the duties are theirs. That applies equally to a shop, a hotel, a construction company and a café. The installer or the streaming service does not make those decisions for you.

What every camera owner must do

1. A warning sign in a visible place. The sign is mandatory; in practice it goes at the entrance so people see it before they enter the camera's field of view; where it is displayed, people are treated as informed. Good practice is to state on it who is carrying out the surveillance and how to contact them.
2. Written rules. Set down the purpose and scope of the surveillance (which camera covers which area), how long it runs, the retention period for recordings, and who has access and how recordings are stored and destroyed.
3. Retention period. For ordinary footage the law sets no single number: the period should be what the purpose requires and what you can justify. Write it down and set the recorder to delete older footage automatically after that time.
4. Restricted access. Only people your rules allow should see recordings and live video: separate user accounts, strong passwords, and the recorder's web interface never exposed to the internet.
5. Answering requests. A data subject has the right to ask for information about the data processed about them. Know who in your company answers such requests.

Cameras in the workplace

The law allows video surveillance at work only in exceptional cases — for the safety of people and the protection of property, where that purpose cannot be achieved by other means.

• Surveillance in changing rooms and hygiene facilities (toilets, showers) is not allowed.
• Employees must be notified about the surveillance in writing. In practice this is done with a signature before the camera is switched on.
• If you want to show a workspace online — a kitchen or a workshop, say — you are showing your staff to a wide audience. Before deciding, consult a lawyer or the regulator.

Live streaming online is a separate question

A few people watch an internal security camera. Anyone can watch one that is on a website. What is acceptable on a recorder may be too much online. Practical rules:

• Show the view, not the people: the slope, the sea, the overall building site, the city panorama.
• Where identifying people is not necessary, do not make it possible: mount the camera high and far, use a wide angle and a lower resolution so faces and number plates cannot be read.
• Use the camera's privacy mask to cover neighbours' windows, private yards and the till. Note that the mask also applies to your recordings.
• Do not put entrances, tills, guests' tables or children's areas online.
• If the stream is meant only for specific people, use a password or email verification, viewing hours and the Live switch — see protecting a stream.

Public spaces — streets, squares, beaches, parks — call for particular care. For a private company, publishing such a space online carries more risk, and municipalities have duties of their own. Ask the regulator or a lawyer before such a project. Examples: city cameras, beaches.

Do I need a data protection officer?

A small business usually does not. Appointing a DPO is required of public institutions and of organisations that process data about very large numbers of people or carry out large-scale, systematic monitoring. A café, shop or hotel with a few cameras is normally not covered — but the criteria are in the law, so check if in doubt.

Fines

Breaches of the video surveillance rules are fined in thousands of lari — as a rough guide, from about 1,000 to 6,000 GEL, depending on the type of breach, repetition and the size of the organisation. Check the exact amounts in the current text of the law. A sign and a one-page policy cost less than a fine.

How we can help

NEWTECH sells and installs cameras, so these questions come up every day. We can help prepare the warning sign and a draft of your written surveillance rules, and set retention periods and privacy masks on the recorder. This is not a legal service — a lawyer should review the final document. Contact us: +995 577 79 53 77, info@videocamera.ge.