Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Georgia |
|---|---|
| Statute citation | O.C.G.A. §§ 10-1-910 to 10-1-915 (Georgia Personal Identity Protection Act) (amended 2024) |
| Individual notice timing | Most expedient time possible and without unreasonable delay Georgia requires information brokers |
| Attorney general notice | No Georgia does not require notification to the Attorney General or any state agency; notification |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | No |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Georgia 'breach of the security of the system' means unauthorized acquisition of an individual's electronic data that compromises the security, confidentiality, or integrity of personal information of such individual maintained by an information broker or data collector. Good faith acquisition or use of personal information by an employee or agent of an information broker or data collector for the purposes of such information broker or data collector is not a breach of the security of the sys |