რა არის GDPR?

ვრცლად

GDPR EU-ის Parliament-მა 2016 ჩამოაყალიბა, 2018 May 25-ში effective გახდა. 99 article, 173 recital. Replaces Data Protection Directive 1995. ფინსი მაქს: 4% annual global revenue ან €20M (whichever higher). Real cases: Meta €1.2B (2023), Google €50M (2019), British Airways €20M (2020).

What is "personal data": ნებისმიერი info რომელიც identify-ს უწევს ფიზიკურ პირს — name, email, IP address, cookie, location, photo, behaviour pattern. Anonymous data (irreversibly aggregated) GDPR-ში არ ხვდება.

Legal bases (6): (1) **Consent** — explicit, opt-in (cookie banners). (2) **Contract** — to fulfill service to user. (3) **Legal obligation** — accounting, taxes. (4) **Vital interests** — life-threatening. (5) **Public task** — government. (6) **Legitimate interests** — business need balanced against user rights.

User rights: (1) **Access** — request all data company holds. (2) **Rectification** — correct inaccurate data. (3) **Erasure** ("right to be forgotten") — delete data. (4) **Portability** — export in machine-readable format. (5) **Restriction** — pause processing. (6) **Object** — opt-out marketing. Response within 30 days mandatory.

Website-level GDPR baseline: (1) **Cookie consent banner** — opt-in (not opt-out), categorize functional/analytics/marketing. (2) **Privacy policy** — clear, accessible, lists data + purpose + retention. (3) **Cookie policy** — separate from privacy. (4) **Data Processing Agreement (DPA)** — with hosting provider, analytics, payment. (5) **Right to be forgotten flow** — automated where possible. (6) **Breach notification** — 72 hours to authority + users.

Georgian context: საქართველო EU-ში არ არის, მაგრამ GDPR applies თუ EU residents-ს ემსახურები. ქართული Personal Data Protection Inspector — local authority. Cost compliance: 2,000-10,000 ₾ initial setup. Tools: Cookiebot ($10/mo), OneTrust (enterprise), Plausible (DPA-compliant analytics, no consent needed).