Guam. Breach notification. Act
GU breach lawGuam data breach notification law (9 GCA §§ 48-10 et seq. (Notification of Breaches of Personal Information))
Partly verified
Low confidence.Could not fetch statute text or Perkins Coie Guam page; citation confirmed via NCSL, other details from recollection and need verification.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Guam residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN, driver's licence/ID, financial account numbers with codes.
- Key themes
- Unique features
Modelled on early US laws; narrow PI; AG enforcement with per-breach penalty cap.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Guam requires the maintaining entity to notify the owner as soon as practicable. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; no regulator notice
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $150,000 per breach or series of breaches (AG action)
§3Dates
- Key dates
- Adopted
- In force
- Enacted by P.L. 30-174 (2009) per secondary sources; no amendment identified
§4Text and authority
- Text
- Authoritative text guamcourts.org
- Authority
- Office of the Attorney General of Guam
§5Where it applies
- Domestic law of
- Guam
§6Sources and verification
- Sources consulted
- Verification
Low confidence.
Partly verified
Low confidence.Could not fetch statute text or Perkins Coie Guam page; citation confirmed via NCSL, other details from recollection and need verification.