State Agency Website
Timing of Consumer Notification
“Most expedient time possible and without unreasonable delay”
Method of Notice
Mail or phone. Email permitted if complies with E-SIGN.
Breach Definition
Unauthorized acquisition of individual’s electronic data that compromises security, confidentiality, or integrity of personal information of such individual maintained by information broker or data collector.
PII Definition

Individual’s first name or first initial and last name in combination with any of these when not encrypted or redacted:

  1. Social Security number;
  2. Driver’s license number or state identification card number;
  3. Account number, credit card number, or debit card number, if such number could be used without additional identifying information, access codes, or passwords;
  4. Account passwords or personal identification numbers or other access codes; or
  5. Any of above when not in connection with first name or first initial and last name, if information compromised would be sufficient to perform or attempt to perform identity theft against person whose information was compromised.
Third Party Notice
If entity maintains covered information for someone else, it must notify them within 24 hours after discovery of breach.
How to Notify
No specific content requirement.
Substitute Notice
All:  (a) email , if the Entity has email address for individuals to be notified; (b) conspicuous posting of notice on Entity’s Website, if it maintains one; and (c) notification to major statewide media.
Credit Monitoring
Not required.
When to Notify Credit Agencies
If more than 10,000 Georgia residents must be notified.
This State's Law
State Government Agency Notification Required
Not required