Georgia Cyber Attack Laws: Penalties, Breach Notice, and Enforcement

Georgia cyber attack laws run on two tracks. The Georgia Computer Systems Protection Act makes hacking, computer theft, and related conduct a felony carrying up to 15 years in prison and a $50,000 fine. The Georgia Personal Identity Protection Act requires businesses and data collectors that hold personal information on Georgia residents to notify those residents when a breach exposes their data. Victims can also sue attackers directly for their losses, and federal laws often apply alongside the state statutes.

Criminal Penalties for Cyber Attacks

The Georgia Computer Systems Protection Act is codified at O.C.G.A. § 16-9-90 and following.¹ It defines five separate computer crimes. Four of them are serious felonies:

Computer theft: using a computer without authorization to take someone’s property, obtain property through deception, or convert property in violation of a legal obligation.
Computer trespass: using a computer without authorization to delete data, interfere with programs, or cause a system to malfunction.
Computer invasion of privacy: examining someone’s employment, medical, financial, or other personal data through a computer without authorization.
Computer forgery: creating, altering, or deleting data in a computer in a way that would be forgery if done to a physical document.

Each of these four carries up to 15 years in prison and a fine of up to $50,000.² Because they are punishable by more than a year of imprisonment, all four are felonies under Georgia’s general classification scheme.

The fifth offense, computer password disclosure, is treated more lightly. Sharing a password or access code without authorization becomes criminal when the resulting damages — including the value of services used and the victim’s costs — exceed $500. The maximum sentence is one year in jail and a $5,000 fine.²

A definition that stretches across all of these offenses: acting “without authority” includes using a computer in any way that exceeds the permission granted by its owner.³ That reach matters for insider cases. An employee who has legitimate login credentials but uses them beyond what the employer allowed can still fall within the statute.

Unauthorized Access Alone Is Now a Crime

Before 2018, Georgia prosecutors generally had to show one of the specific harms above: theft, trespass, privacy invasion, or forgery. SB 315 changed that. It added a standalone offense for accessing a computer with knowledge that the access is unauthorized, even if the person does not damage, steal, or alter anything. The bill carved out exceptions for terms-of-service violations and for “legitimate business activity,” which offers some cover for security researchers but has not fully resolved concerns about how the law could reach vulnerability testing and disclosure work.

Civil Lawsuits by Victims

The Computer Systems Protection Act does more than authorize prosecution. Anyone whose property or person is injured by a computer crime can sue for damages and the costs of the lawsuit. Recoverable damages include lost profits and the expenses the victim incurred responding to the attack.² The civil claim stands on its own. A victim can file suit whether or not prosecutors bring charges. For a business hit by ransomware or a network intrusion, that can mean recovering forensic investigation costs, system restoration expenses, and revenue lost during downtime.

When a Breach Triggers Notification

Georgia’s breach notification duty is narrower than many people assume. It applies only when specific categories of unencrypted “personal information” are compromised. The data has to pair a resident’s first name or first initial and last name with at least one of the following:

Social Security number
Driver’s license or state ID number
Account number, credit card number, or debit card number, if usable without additional passwords or access codes
Account passwords, PINs, or other access codes

Both the name and the data element must be unencrypted and unredacted for the notification rule to apply.⁴ A “breach of security” requires that someone without authorization actually acquired, or is reasonably believed to have acquired, that information. Detecting an intrusion into a network is not, by itself, a reportable breach unless personal information was actually accessed or taken.

Encryption is an effective safe harbor. If the breached data was encrypted and the encryption key was not also compromised, notification is generally not required under Georgia law.⁴ Federal rules may still apply, but the state statute’s hook disappears.

Who Must Notify, and How Fast

Any information broker or data collector that maintains computerized personal information on Georgia residents must notify affected individuals after discovering a breach.⁵ Georgia does not set a fixed number of days. The standard is “in the most expedient time possible and without unreasonable delay.” The clock can pause only to determine the scope of affected individuals, restore system security, or honor a law enforcement hold.

Third-party vendors face a much tighter rule. A service provider that discovers a breach involving unencrypted personal information it stores for a client must notify the data owner within 24 hours.⁵ The data owner then handles the notice to residents. The 24-hour vendor timeline is one of the shortest in the country and often catches companies off guard mid-incident.

A law enforcement agency can request a delay in notification if immediate disclosure would compromise a criminal investigation. Once the agency determines the investigation will no longer be impeded, notice must go out promptly.⁵

The notice itself must describe the types of personal information that were compromised, explain what the organization has done about it, and provide contact information so affected individuals can ask questions.⁵ Georgia does not require specific identity-theft tips or free credit monitoring, though many organizations include them.

When a single breach affects more than 10,000 Georgia residents, the organization must also notify all nationwide consumer reporting agencies without unreasonable delay, including the timing, distribution, and content of the resident notices.⁵

How Notice Must Be Delivered

Three delivery methods are permitted:⁴

Written notice by physical mail to the affected individual.
Electronic notice by email, but only if it complies with the federal E-SIGN Act (15 U.S.C. § 7001), which requires the recipient to have previously consented to electronic communications.
Substitute notice, available when the cost of individual notification exceeds $250,000, more than 500,000 people are affected, or the organization lacks sufficient contact information. Substitute notice requires all three of the following together: email to anyone whose address the organization has, a conspicuous posting on the organization’s website, and notice to major statewide media outlets.

An organization with its own breach notification policy baked into an information security program can follow that internal policy instead, as long as the timing matches the statute’s “without unreasonable delay” standard.

The Enforcement Gap in Georgia’s Notification Law

Georgia’s breach notification statute does not create a private right of action for affected residents, and it does not spell out regulatory penalties for organizations that fail to notify. The Attorney General’s office could potentially pursue enforcement through Georgia’s general consumer protection statutes, but the notification law itself contains no fine schedule or explicit enforcement authority. That gap is not permission to skip notification. Federal regulators still act, and civil lawsuits under other theories, such as negligence, remain available. It does mean the state statute carries less built-in bite than those in many other states.

Data Security Duties Before a Breach

The Personal Identity Protection Act requires any business or data collector to put reasonable security measures in place to protect personal information from unauthorized access. “Reasonable” scales with the sensitivity of the data and the size and complexity of the business. Georgia does not prescribe specific technical controls, which gives organizations flexibility and also removes any safe checklist.

State agencies operate under tighter rules. O.C.G.A. § 50-25-4 gives the Georgia Technology Authority broad power to set technology security policies, standards, and services for state government.⁶ The GTA’s Enterprise Information Security Policy requires every agency that owns or maintains state information assets to run an internal security program meeting state and federal requirements.⁷

Federal Laws That Often Apply

Georgia’s statutes do not stand alone. The federal Computer Fraud and Abuse Act, 18 U.S.C. § 1030, criminalizes unauthorized access to protected computers, a category that effectively covers any computer connected to the internet.⁸ Federal prosecutors can bring CFAA charges alongside or instead of Georgia charges, with penalties ranging from a fine and one year of imprisonment for basic unauthorized access up to 20 years when an offense causes serious bodily injury. Federal involvement is more likely when attacks cross state lines, target critical infrastructure, or involve national security data.

Financial institutions, auto dealers that arrange financing, and other entities handling consumer financial data also fall under the Gramm-Leach-Bliley Act. The FTC’s Safeguards Rule requires covered companies to maintain a written information security program with administrative, technical, and physical safeguards, and now requires reporting to the FTC when unencrypted data of 500 or more consumers is accessed without authorization.⁹ Georgia businesses that are subject to GLBA have to comply with both the federal rule and the state’s Personal Identity Protection Act.

Who Investigates and Prosecutes Cyber Crime in Georgia

Criminal investigation of cyber incidents is handled primarily by the Georgia Bureau of Investigation’s Cyber Crime Center, known as G3C. It is staffed with Special Agents and Digital Forensic Investigators focused on online fraud, network intrusions, and crimes involving digital media, and it works cooperatively with the Governor’s office, the GTA, and Augusta University to assist local and state law enforcement.¹⁰

The Attorney General’s White Collar and Cyber Crime Unit investigates and prosecutes cyber-enabled theft targeting businesses and consumers across the state.¹¹ The AG’s role here is prosecution rather than civil regulatory enforcement of the breach notification statute.

Reporting Rules for Government Entities

Separate from the notification law for private businesses, Georgia requires certain government agencies and utilities to report cyber attacks under O.C.G.A. § 38-3-22.2.¹² The director of emergency management and homeland security sets the reporting mechanism, required information, and timeframe. This duty runs in addition to, not in place of, any obligation to notify individuals affected by a breach. A government entity hit by an attack has to handle both channels at once.

1
Justia. Georgia Code 16-9-90 – Short Title
2
Justia. Georgia Code 16-9-93 – Computer Crimes Defined; Exclusivity of Article; Civil Remedies; Criminal Penalties
3
Justia. Georgia Code 16-9-92 – Definitions
4
FindLaw. Georgia Code Title 10 – Commerce and Trade 10-1-911 – Definitions
5
Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information
6
Justia. Georgia Code 50-25-4 – General Powers
7
Georgia Technology Authority. Enterprise Information Security Policy (PS-08-005)
8
Office of the Law Revision Counsel. 18 USC 1030 – Fraud and Related Activity in Connection with Computers
9
Federal Trade Commission. Gramm-Leach-Bliley Act
10
Georgia Bureau of Investigation. Georgia Cyber Crime Center (G3C)
11
Office of the Attorney General. Cybersecurity
12
Justia. Georgia Code 38-3-22.2 – Sharing and Reporting of Cyber Attacks and Data Breaches