Data Breach Notice to Residents and State Authorities in Georgia
At a glance
| Covered entity and service provider | Fee-based information broker primarily furnishing personal information to unaffiliated third parties; processor storing its data must notify broker within 24 hours (§§ 10-1-911(3), 10-1-912(a)-(b)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of electronic data; name plus listed IDs/accounts/access codes, or listed data alone if sufficient for identity theft; public records excluded (§ 10-1-911(1), (6)) |
| Risk screen or notice exception | No general harm-likelihood screen in this scheme; good-faith employee/agent use is excluded if no further unauthorized use or disclosure (§§ 10-1-911(1), 10-1-912(a)) |
| Individuals who receive notice | Georgia residents whose unencrypted personal information was or reasonably is believed acquired without authorization (§ 10-1-912(a)) |
| Individual notice deadline and clock | Most expedient time possible without unreasonable delay after discovery or notification; no numbered outside day limit (§ 10-1-912(a)) |
| Regulator threshold and deadline | No routine state-regulator notice in the information-broker and data-collector breach-notice section (§ 10-1-912(a)-(d)) |
| Consumer-reporting-agency notice | More than 10,000 Georgia residents notified at once: tell nationwide consumer-reporting agencies timing, distribution, and content without unreasonable delay (§ 10-1-912(d)) |
| Individual delivery and content | Written, telephone, or federal e-signature-compliant electronic notice; no universal letter content specified (§ 10-1-911(4)(A)-(C)) |
| Substitute notice conditions and channels | Cost over $50,000, class over 100,000, or insufficient contacts; email if available, website if maintained, and major statewide media together (§ 10-1-911(4)(D)) |
| Delays and alternate compliance | Law-enforcement determination that notice compromises criminal investigation, until clearance; qualifying own security-policy notice can comply if timing is met (§§ 10-1-911(4)(D), 10-1-912(c)) |
Requirements one by one
Who the private rule covers
Georgia's definition in § 10-1-911(3) reaches a person or entity collecting, assembling, or transmitting personal information for a fee and primarily to furnish it to unaffiliated third parties. Merely holding customers' data for one's own transactions does not by itself satisfy that information-broker definition. Section 10-1-912(b) separately gives a business storing data for an information broker a 24-hour deadline, measured from discovery, to tell the broker about an unauthorized acquisition.
The breach and affected residents
Under § 10-1-911(1), a breach involves unauthorized acquisition of electronic data, not mere access. Covered data include name-linked identifiers, financial-account numbers usable without extra credentials, and access codes; listed identifiers can also count without a name if enough for identity theft. The definition excludes lawfully public government-record information and good-faith employee use that is neither misused nor disclosed without authority. Under § 10-1-912(a), resident notice depends on acquired, unencrypted personal information or a reasonable belief of that acquisition.
Clocks and agency notice
Resident notice goes out in the “most expedient time possible and without unreasonable delay” after discovery or notification. Section 10-1-912(a) allows measures needed to identify the scope and restore system integrity; it states no numbered outside limit. If more than 10,000 Georgia residents must be notified at one time, § 10-1-912(d) adds nationwide consumer-reporting agency notice describing timing, distribution, and content, without unreasonable delay.
Method and substitute notice
Section 10-1-911(4) allows written or telephone notice and electronic notice consistent with the federal electronic-signatures rule it cites. If direct notice costs more than $50,000, the class exceeds 100,000, or contacts are insufficient, substitute notice combines available email, a website posting if one is maintained, and major statewide media. A qualifying security policy with its own resident-notice procedure may satisfy the section when its timing matches the statute.
What trips people up
The processor clock is different. The 24-hour rule in § 10-1-912(b) belongs to a person or business holding data for the broker; it does not become a 24-hour outside deadline for the broker's resident letters.
A statewide filing is not specified here. Section 10-1-912(a)-(d) lists resident, owner, and consumer-reporting-agency notices, with no routine Attorney General submission. The reporting-agency threshold is more than 10,000 residents at one time, not a running lifetime count.
An investigation delay requires law enforcement. Under § 10-1-912(c), the agency must determine that notice would compromise a criminal investigation; notice follows its clearance decision.
Common questions
Does this section prescribe the resident letter's words? No. It defines the trigger, recipients, timing, and delivery methods but provides no universal content list for the resident letter. Incident facts still need to be stated accurately.
Can an information broker follow its own notice policy? Yes, if it keeps an information-security policy with notification procedures, meets the statutory timing, and notifies affected people according to that policy under § 10-1-911(4)(D).
Statutes and sources
- Ga. Code §§ 10-1-911, 10-1-912 — definitions, resident and owner notice, reporting agencies, methods, delay, and alternate policy compliance. Official 2007 enrolled amendment: https://www.legis.ga.gov/api/legislation/document/20072008/75800 (accessed 2026-10-14)
Source links
Every statute quoted above, linked, with the date we checked it.
What does Georgia law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Georgia law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace