Georgia Data Breach Notification Law

Who the Georgia data breach notification law covers

Georgia's statute is narrow. Only two groups are in scope ²:

• Information brokers: businesses that, for fees or dues, collect personal information and pass it to nonaffiliated third parties
• State and local government agencies

So an Atlanta dental office or contractor that never sells personal data is, as a rule, not covered. The breach still matters; the obligations simply arrive from other laws, set out below.

Ordinary companies do get pulled in one way. If you store or process data for a broker or a public agency, you must warn that client within 24 hours of discovering a breach ¹.

What covered businesses must do

Inside that narrow circle, the rule bites: there is no risk of harm test ¹. Once an unauthorized person has acquired unencrypted personal information, or probably has, the letters are owed in the most expedient time possible and without unreasonable delay, with allowance for police requests and for scoping the damage and repairing systems ¹.

The covered data includes an account or card number on its own if it could be used without added codes, account passwords and PINs, and even data elements without a name if they are enough to commit identity theft ². Encrypted or redacted data is outside it, and losing the key does not change that ².

There is no state filing. Above 10,000 residents to notify, the consumer reporting agencies must hear about it ¹. No penalty is written in and no agency is named to enforce it; whether a resident could sue is unresolved.

Why most Georgia businesses still have notice duties

Being outside the Georgia statute rarely means owing no one a letter:

• Neighboring states. A customer or employee who lives in Florida carries a 30-day deadline and a state filing at 500 or more; one from Tennessee carries that state's rules. The all-states breach comparison covers the rest.
• Federal law. A medical or dental office follows HIPAA's notice rule. A tax preparer or mortgage broker is a non-bank financial firm under the FTC Safeguards Rule and needs a written security plan.
• Contracts and policies. Client agreements and cyber coverage commonly demand notice whatever state law says.

The exposure is real: IC3 received 25,936 complaints from Georgians in 2025 with about $535 million lost, ninth highest of any state by losses ³.

What a Georgia business should do after a breach

In the first hours, a Georgia company with cyber coverage opens a claim before anything else, files a report at ic3.gov for the FBI, and leaves systems unwiped so the evidence holds ⁴⁶⁵. Firms outside the state statute need this as much as anyone, because the policy may set the response even where the law does not; what carriers expect lists the usual conditions.

Next, your IT support, backed by a specialist where needed, contains the intrusion along the lines of our breach response steps. Then build a list of the people affected by home state. Their addresses, not yours, decide which laws you answer to. For local support pricing, see managed IT in Atlanta.

Our last check of the Georgia code for this page was October 13, 2026. Nothing here counts as legal advice, and whether the statute reaches your business at all is a threshold question to put to a Georgia lawyer.