Georgia Data Breach Notification Laws: Reporting Rules & Timelines (2026)

Georgia requires data collectors and information brokers to notify affected residents of a security breach in the most expedient time possible and without unreasonable delay under O.C.G.A. 10-1-912. The law sets no specific deadline in days and imposes no penalties for late notification.

Georgia's data breach notification law (Ga. Code 10-1-910 through 10-1-912) was enacted in 2005 and then substantially rewritten by Ga. L. 2007, p. 450 (SB 236), the Act that supplied the short title "Georgia Personal Identity Protection Act," added state and local agencies as covered "data collectors," replaced the earlier "immediately" reporting rule for third-party processors with the current 24 hour deadline, and lowered the substitute notice thresholds from $250,000 and 500,000 individuals to $50,000 and 100,000. Neither section has been amended since. While all 50 states now have breach notification laws on the books, Georgia's stands out for what it lacks: no hard notification deadline, no Attorney General reporting requirement, no specific penalties, and no private right of action for affected consumers.

This law binds only information brokers and government data collectors, plus their third-party data processors; most ordinary Georgia businesses that hold customer data for their own purposes have no notification duty under this statute at all. For the entities the law does cover, notification obligations are relatively light compared to neighboring states. For Georgia residents, it means fewer legal protections when their personal data is compromised. This guide breaks down exactly what the law requires, where it falls short, and what reform efforts have looked like.

Who Must Comply

Georgia's breach notification law applies to two categories of entities defined under Ga. Code 10-1-911:

Information brokers are persons or entities that collect and transmit personal information about individuals to third parties for purposes unrelated to the transaction. Think data brokers, consumer reporting companies, and background check services.

Data collectors are state and local government agencies that maintain computerized data containing personal information of individuals. Certain government agencies focused on traffic safety, law enforcement, or licensing are excluded from this definition.

Any person or business that maintains computerized data on behalf of an information broker or data collector also has obligations under the law. These third-party service providers must notify the data owner within 24 hours of discovering a breach.

What Triggers a Notification

A "breach of the security of the system" means the unauthorized acquisition of an individual's electronic data that compromises the security, confidentiality, or integrity of personal information maintained by an information broker or data collector.

The key word is "acquisition." Good-faith access by an employee or agent of the information broker or data collector does not count as a breach, as long as the personal information is not used for an unauthorized purpose or disclosed to an unauthorized third party.

Definition of Personal Information

Under Ga. Code 10-1-911(6), protected personal information means an individual's first name or first initial and last name combined with any one or more of:

• Social Security number
• Driver's license or state identification card number
• Financial account number, credit card number, or debit card number, if usable without additional identifying information, access codes, or passwords
• Account passwords, PINs, or other access codes

The definition also covers standalone data elements (without the name) if the compromised information would be sufficient to perform or attempt identity theft.

Georgia's definition is notably narrow. Unlike states such as Delaware or California, Georgia does not include medical records, health insurance information, biometric data, passport numbers, or taxpayer identification numbers as protected data elements.

Publicly available information from government records is excluded.

Notification Timeline

Georgia requires notification "in the most expedient time possible and without unreasonable delay." The law does not set a specific number of days.

This vague standard gives businesses flexibility, but it also gives consumers little recourse if a company drags its feet. Compare this to Alabama (45 days), Florida (30 days), or Colorado (30 days), which all set firm deadlines.

The notification timeline can account for:

• Measures necessary to determine the scope of the breach
• Steps needed to restore the reasonable integrity of the data system
• Legitimate law enforcement needs (notification may be delayed if law enforcement determines it would impede a criminal investigation)

How Notification Must Be Provided

Entities can notify affected Georgia residents through any of the methods listed in the definition of "notice" at Ga. Code 10-1-911(4):

• Written notice sent to the individual
• Telephone notice to the individual
• Electronic notice that complies with the federal E-SIGN Act (15 U.S.C. 7001)

Substitute Notice

Substitute notice, under Ga. Code 10-1-911(4)(D), is available when direct notification is impractical because:

• The cost of providing notice exceeds $50,000
• The number of affected individuals exceeds 100,000
• The entity does not have sufficient contact information

Substitute notice requires all three of these steps:

1. Email notice to affected individuals (if addresses are available)
2. Conspicuous posting on the entity's website (if one is maintained)
3. Notification through major statewide media

Notice Content

Georgia's statute does not specify what information the notification must contain. This is another gap. Many states require notifications to include a description of the breach, the types of data exposed, steps the consumer can take, and contact information for the company. Georgia leaves the content entirely to the notifying entity's discretion.

Government Agency Notification

Georgia does not require notification to the Attorney General or any other state agency under the general breach notification statute. This is a significant gap. Most states now require some form of government notification, either to the AG or to a designated state agency, so that regulators can monitor breach trends and pursue enforcement when warranted.

The only government-related notification requirement is to consumer reporting agencies (Equifax, Experian, TransUnion) when a breach affects more than 10,000 Georgia residents. In that case, the entity must notify the agencies promptly regarding the timing, distribution, and content of the individual notices.

Encryption Safe Harbor

Georgia provides a clear encryption safe harbor. The notification requirement does not apply to data that was encrypted or redacted at the time of the breach. If the personal information was properly encrypted, even a confirmed unauthorized acquisition does not trigger notification obligations.

The statute does not address scenarios where the encryption key itself is compromised. Some states, like Delaware, explicitly state that the safe harbor does not apply if the encryption key was also acquired. Georgia's law is silent on this point.

Penalties and Enforcement

This is where Georgia's law is weakest.

The general breach notification statute (Ga. Code 10-1-912) contains no specific penalties for failure to notify. It also provides no regulatory enforcement mechanism and no private right of action for affected individuals.

Some legal analyses note that a violation could potentially be treated as an unfair or deceptive practice under Georgia's Fair Business Practices Act (Ga. Code 10-1-390 et seq.), which authorizes civil penalties of up to $2,000 per willful violation when the Attorney General acts administratively (O.C.G.A. 10-1-397), up to $5,000 per violation in a superior court action, and up to $25,000 per violation for violating an injunction (O.C.G.A. 10-1-405). However, the breach notification statute itself does not explicitly incorporate this remedy, and the practical enforcement record is minimal.

Without a private right of action, Georgia residents cannot directly sue a company for failing to provide timely breach notification. Without mandatory AG notification, the Attorney General's office may not even learn about breaches that affect Georgia residents. This creates a significant enforcement vacuum.

The Telecom Exception: Ga. Code 46-5-214

Georgia has a separate, slightly stronger breach notification provision for telecommunications companies. Under Ga. Code 46-5-214, telecom providers must notify Georgia residents when a breach of telephone records occurs that is "reasonably likely to cause quantifiable harm."

Unlike the general statute, violations of 46-5-214 are explicitly classified as unfair or deceptive practices under the Fair Business Practices Act, giving the Attorney General clearer enforcement authority over telecom breaches.

How Georgia Compares to Neighboring States

Georgia's breach notification law is among the weakest in the Southeast. Here is how it stacks up against its neighbors:

Alabama's law, enacted in 2018, is particularly instructive. The Alabama Data Breach Notification Act includes a 45-day deadline, mandatory AG notification, penalties up to $500,000 per breach plus $5,000 per day for late notification, and a broader definition of personal information. Georgia's law has seen no comparable update since 2007.

Reform Efforts: SB 111 and What Actually Happened

Georgia's legislature attempted to modernize the state's data privacy framework, but the effort did not survive intact.

In the 2025 legislative session, Senate Bill 111, the Georgia Consumer Privacy Protection Act, passed the Georgia Senate by a vote of 53 to 2. The bill would have created a comprehensive consumer data privacy framework modeled after Virginia's approach, applying to entities with over $25 million in annual revenue processing data of at least 175,000 Georgia residents.

The bill did not make it out of the Georgia House in 2025. The House withdrew and recommitted the bill on March 27, 2025. Georgia's General Assembly runs on a two-year biennium, so the bill carried over into 2026 rather than dying with the session.

Privacy advocates were critical of the bill even before its 2025 stall. The Electronic Privacy Information Center (EPIC) gave the bill a score of 6 out of 10, and the ACLU of Georgia called it potentially "the worst consumer protection act in the country."

In 2026, a House committee replaced SB 111's entire privacy text with an unrelated substitute expanding tax-credit eligibility for rural hospitals. The House passed that substitute 162 to 1 on March 31, 2026, the Senate agreed to it on April 2, 2026, and Governor Kemp signed it into law as Act 462 on May 11, 2026, effective July 1, 2026. The Governor's own signing announcement describes the law solely as a rural hospital tax measure, with no mention of consumer privacy or data breach rules.

No standalone Georgia comprehensive privacy bill has been enacted. Georgia's breach notification law, last amended in 2007, continues to operate without meaningful updates.

Practical Steps for Georgia Residents

If you receive a data breach notification, the Georgia Attorney General's Consumer Protection Division recommends these steps:

1. Place a credit freeze with all three major credit bureaus (Equifax: 1-888-766-0008, Experian: 1-888-397-3742, TransUnion: 1-800-680-7289)
2. Set fraud alerts on your credit files
3. Monitor financial accounts closely for unauthorized transactions
4. Change passwords on any accounts that may have been affected
5. File an identity theft report at identitytheft.gov if you suspect fraud

You can file a complaint with the Georgia Attorney General at (404) 651-8600 or toll-free at (800) 869-1123.

For a broader overview of Georgia's data privacy landscape, including the state's approach to consumer privacy rights and data protection beyond breach notification, see our Georgia Data Privacy Laws guide.

This article provides general legal information about Georgia's data breach notification requirements. It is not legal advice, and it does not create an attorney-client relationship. Data breach response involves time-sensitive obligations. Consult a qualified attorney licensed in Georgia for guidance specific to your situation.

More Georgia Laws

• Georgia Deepfake Laws
• Georgia Employee Monitoring Laws
• Georgia GPS Tracking Laws
• Georgia Recording Laws

Frequently Asked Questions

Does Georgia have a specific deadline for data breach notifications?

No. Georgia requires notification 'in the most expedient time possible and without unreasonable delay,' but the statute does not set a specific number of days. This contrasts with states like Florida (30 days) and Alabama (45 days) that impose firm deadlines.

Do companies have to notify the Georgia Attorney General about a data breach?

No. Georgia's general breach notification statute does not require notification to the Attorney General or any state agency. The only government-related requirement is notifying consumer reporting agencies when more than 10,000 Georgia residents are affected.

What penalties does Georgia impose for failing to notify consumers of a data breach?

Georgia's breach notification statute does not contain specific penalties for non-compliance. There is no private right of action for consumers and no designated enforcement mechanism. Some legal analyses suggest a violation could be treated as an unfair practice under the Fair Business Practices Act, but the practical enforcement record is minimal.

Does Georgia's breach notification law cover medical records or biometric data?

No. Georgia's definition of personal information is limited to name combined with Social Security numbers, driver's license numbers, financial account data with access codes, and account passwords. Medical records, health insurance information, biometric identifiers, and passport numbers are not covered.

Is encrypted data exempt from Georgia's breach notification requirement?

Yes. Georgia provides an encryption safe harbor. If personal information was encrypted or redacted at the time of the breach, the notification requirement does not apply. However, unlike some states, Georgia's law does not address whether the safe harbor still applies if the encryption key was also compromised.