The Georgia data breach notification law, formally the Personal Identity Protection Act at Georgia Code §§ 10-1-910 through 10-1-912, requires information brokers and government data collectors to notify Georgia residents when their unencrypted personal information has been acquired by an unauthorized person. It is narrower than most states’ breach laws: it does not reach every business, it applies only to unencrypted data, and it turns on actual acquisition of information rather than mere access to a system.
Who Must Notify
Only two categories of entities carry the notification obligation directly. An information broker is a person or company that, for fees or dues, collects, compiles, or communicates information about individuals primarily to provide personal information to unaffiliated third parties. A data collector is a state or local government entity, including public universities, commissions, and other government bodies. Government agencies whose records exist primarily for traffic safety, law enforcement, licensing, or public access to court and property records are excluded from both definitions.1Justia. Georgia Code 10-1-911 – Definitions
That leaves a lot of familiar organizations outside the statute’s direct reach. A retailer, hospital, or private employer that suffers a breach may not qualify as an information broker or data collector, so the GPIPA’s notification duties may not apply to them under Georgia law (federal rules can be a different story).
There is one obligation that runs to a broader group. Any person or business that maintains data on behalf of an information broker or data collector must notify the broker or collector of a breach within 24 hours of discovering it.2Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information Vendors and processors need to know that rule even if they aren’t covered entities themselves.
What Triggers the Notification Duty
The statute defines a breach as the unauthorized acquisition of electronic data that compromises the security, confidentiality, or integrity of an individual’s personal information.1Justia. Georgia Code 10-1-911 – Definitions Acquisition is the operative word. Someone must actually obtain the data. An intrusion into a system, without exfiltration or copying, is not enough on the statute’s own terms.
Personal information means an individual’s first name (or first initial) and last name combined with at least one of the following:
- Social Security number
- Driver’s license or state ID number
- Financial account, credit card, or debit card number, if the number could be used without additional passwords or access codes
- Account passwords, PINs, or other access codes
The law also covers situations where any of these elements are compromised without the person’s name, provided the exposed information would be enough to attempt identity theft.1Justia. Georgia Code 10-1-911 – Definitions
The Encryption Safe Harbor
Notification is required only for unencrypted personal information. If the compromised data was encrypted or redacted at the time of the breach, the statute does not require notice.2Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information A stolen laptop full of Social Security numbers does not trigger GPIPA notice if the drive is properly encrypted.
When and How Notice Must Be Sent
Once a covered entity discovers a breach of unencrypted personal information, it must notify affected Georgia residents “in the most expedient time possible and without unreasonable delay.” The statute allows time to determine the scope of the breach and to restore the security of the data system before that clock becomes urgent.2Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information There is no fixed 30- or 60-day deadline the way some other states set. Flexibility cuts both ways: it gives entities room to investigate, but it makes the line for “unreasonable delay” a judgment call.
The statute does not dictate what the notice must say. That is a real gap compared to laws in other states, which often mandate specific content.
Acceptable Methods
Four methods are allowed:
- Written notice mailed to the affected individual.
- Telephone notice.
- Electronic notice by email, provided it complies with the federal Electronic Signatures in Global and National Commerce Act (15 U.S.C. § 7001).
- Substitute notice, available when the cost of direct notice would exceed $50,000, when the affected group exceeds 100,000 individuals, or when the entity lacks sufficient contact information. Substitute notice requires all three of: email to anyone whose address is available, a conspicuous posting on the entity’s website, and notification to major statewide media outlets.1Justia. Georgia Code 10-1-911 – Definitions
Substitute notice is not a shortcut. It is only available when direct notice is genuinely impractical, and it still demands a multi-channel effort.
When Credit Bureaus Must Also Be Told
If a single breach affects more than 10,000 Georgia residents, the entity must also notify all nationwide consumer reporting agencies without unreasonable delay. The notice to the agencies must cover the timing, distribution, and content of the notices sent to individuals.2Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information Smaller breaches do not trigger this obligation unless that threshold is met in a single incident.
When the Timeline Can Pause or Shift
Two provisions modify the standard timing.
Law enforcement delay. The notification timeline can be paused if a law enforcement agency determines that sending notice would compromise a criminal investigation. Once law enforcement decides notification will no longer interfere, the entity must proceed without further delay.2Justia. Georgia Code 10-1-912 – Notification Required Upon Breach of Security Regarding Personal Information The statute sets no maximum duration for this hold. Document any such request in writing.
Internal policy safe harbor. An entity that maintains its own notification procedures as part of an information security policy is deemed in compliance with the GPIPA, as long as those procedures are consistent with the statute’s timing requirements and the entity actually follows its own policy when a breach occurs.1Justia. Georgia Code 10-1-911 – Definitions A policy that permits indefinite delay would not satisfy the “most expedient time possible” standard.
Enforcement and Whether Individuals Can Sue
The Georgia Attorney General enforces the GPIPA. The statute does not set specific fine amounts or a per-violation penalty schedule, so remedies are pursued through the courts rather than by a fixed statutory fee. Because the notification obligation runs to each affected individual, a large-scale failure to notify is not a single violation but as many violations as there are unnotified residents.
Individuals generally cannot sue over a notification failure on their own. Georgia Code § 9-2-8 provides that no private right of action arises from any Act passed after July 1, 2010, unless the statute expressly creates one, and the GPIPA does not.3Justia. Georgia Code 9-2-8 – Private Rights of Action Not Created Unless Expressly Stated A Georgia court has also observed that the legislature “only imposed ‘notice’ obligations after a data breach has occurred” and did not impose standards of conduct for data security practices themselves.
If you were affected by a breach and want to bring a claim yourself, you have to rely on other legal theories such as negligence or breach of contract. Section 9-2-8 preserves those alternatives, but they require proof of elements beyond a missed notice deadline, typically including actual harm.
Overlap With Federal Rules
Organizations in some industries face parallel federal duties. Healthcare providers and insurers covered by HIPAA must comply with the HIPAA Breach Notification Rule, which sets a 60-day outside deadline and prescribes specific content for the notice.4U.S. Department of Health and Human Services. HIPAA Breach Notification Rule Financial institutions covered by the Gramm-Leach-Bliley Act must follow the FTC’s Safeguards Rule, which has its own breach notification component.5Federal Trade Commission. Gramm-Leach-Bliley Act
Compliance with one framework does not automatically satisfy the other. An entity already following HIPAA can often rely on that process to meet the GPIPA through the internal-policy safe harbor, provided the timing lines up with Georgia’s “most expedient time possible” standard. Check both regimes rather than assuming a single procedure covers everything.