Georgia. Breach notification. Act
GA breach lawGeorgia data breach notification law (Ga. Code §§ 10-1-910 to 10-1-912)
Partly verified
Medium confidence.2014-era summary used; recent amendments not confirmed.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Georgia residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, account/card numbers, account passwords/PINs; any element alone if sufficient for identity theft.
- Key themes
- Unique features
Strict vendor timeline (24 hours); no regulator notice; high CRA threshold.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Georgia requires the maintaining entity to notify the owner within 24 hours of discovering the breach, among the tightest vendor deadlines in the US. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; no AG notice; CRAs if >10,000 residents
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Not specified in statute; enforcement via Fair Business Practices Act
§3Dates
- Key dates
- Adopted
- In force
- Amended by SB 236 (2007) to cover all persons/businesses, not only information brokers
§4Text and authority
- Text
- No authoritative text located.
- Authority
- Georgia Attorney General (Consumer Protection Division)
§5Where it applies
- Domestic law of
- Georgia
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.2014-era summary used; recent amendments not confirmed.