1. Home
  2. State breach laws
  3. Georgia

Georgia data breach notification law

What Georgia requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by O.C.G.A. §§ 10-1-910 to 10-1-912.

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Georgia is a quiet state. There is no fixed deadline, no requirement to notify the Attorney General, and the law covers only information brokers and state or local government agencies, not businesses in general. Georgia breaches still surface, through SEC and HHS filings and through other states' Attorneys General when the affected residents live elsewhere, but fewer competitors are watching those channels. When a Georgia organization does appear, the field is usually less crowded.

See recent Georgia breach filings →

Requirements in detail

Statute
O.C.G.A. §§ 10-1-910 to 10-1-912
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering or being told of the breach. A delay is allowed if law enforcement determines notice would compromise a criminal investigation. The law applies only to information brokers and state or local government agencies, not to businesses in general.
Attorney General notification
No. The law does not require notice to the Attorney General or any other state regulator. Nationwide consumer reporting agencies must be notified without unreasonable delay when more than 10,000 Georgia residents are notified at one time. Vendors holding data for an information broker or agency must notify it within 24 hours of discovery.
Penalties
The breach notification statute does not set any civil penalty or name an enforcing agency.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Georgia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Georgia has no law limiting breach lawsuits for organizations that maintain a security program.

Georgia breach notification FAQ

What is the data breach notification deadline in Georgia?

In the most expedient time possible and without unreasonable delay after discovering or being told of the breach. A delay is allowed if law enforcement determines notice would compromise a criminal investigation. The law applies only to information brokers and state or local government agencies, not to businesses in general. The governing law is O.C.G.A. §§ 10-1-910 to 10-1-912.

Does Georgia require notifying the Attorney General of a data breach?

No. The law does not require notice to the Attorney General or any other state regulator. Nationwide consumer reporting agencies must be notified without unreasonable delay when more than 10,000 Georgia residents are notified at one time. Vendors holding data for an information broker or agency must notify it within 24 hours of discovery.

What are the penalties for failing to report a data breach in Georgia?

The breach notification statute does not set any civil penalty or name an enforcing agency.

Can individuals sue over a data breach in Georgia?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Georgia?

Georgia's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Georgia limit breach lawsuits for companies with a cybersecurity program?

No. Georgia has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed September 11, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Georgia Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →