Skip to content
Network USA

GA · Breach notification statute

Georgia data breach notification law

A summary of the Georgia breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

O.C.G.A. §§ 10-1-910 to 10-1-915 (Georgia Personal Identity Protection Act) (amended 2024)

Last amended
2024 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

Most expedient time possible and without unreasonable delay Georgia requires information brokers

Attorney general notice

No Georgia does not require notification to the Attorney General or any state agency; notification

What counts as a breach

In Georgia 'breach of the security of the system' means unauthorized acquisition of an individual's electronic data that compromises the security, confidentiality, or integrity of personal information of such individual maintained by an information broker or data collector. Good faith acquisition or use of personal information by an employee or agent of an information broker or data collector for the purposes of such information broker or data collector is not a breach of the security of the sys

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNo
Paper recordsNo
Private right of actionNo
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in Georgia

230 reports to HHS OCR affecting 38,859,962 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in Georgia.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Aflac Incorporated (“Aflac”)Health Plan13,924,906Aug 8, 2025Hacking/IT IncidentUnder investigation
Managed Care of North AmericaBusiness Associate8,627,242May 26, 2023Hacking/IT IncidentArchive (closed)
NASCOBusiness Associate1,744,655Oct 10, 2023Hacking/IT IncidentArchive (closed)
St. Joseph's/Candler Health System, Inc.Healthcare Provider1,400,000Aug 10, 2021Hacking/IT IncidentArchive (closed)
MCBS, LLCBusiness Associate1,261,464Jun 26, 2026Hacking/IT IncidentUnder investigation

Frequently asked questions

When must Georgia businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the Georgia timing rule as: "Most expedient time possible and without unreasonable delay Georgia requires information brokers". (Source: PRC 2026 survey extract.)

Does Georgia require notice to the attorney general?

The PRC 2026 extract notes: "No Georgia does not require notification to the Attorney General or any state agency; notification". (Source: PRC 2026 survey extract.)

Does the Georgia law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the Georgia breach law.

Does the Georgia law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the Georgia breach law.

Does the Georgia law cover paper records?

No. The PRC 2026 survey records the Georgia law as covering computerised data only, not paper records.

Is there a private right of action in Georgia?

No. The PRC 2026 survey does not record a private right of action under the Georgia breach law.

Is credit monitoring required in Georgia?

No. The PRC 2026 survey does not record a credit monitoring requirement in Georgia.

How does the Georgia law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the Georgia statute, and see our HIPAA vs state breach notification laws guide.

Sources