Cybersecurity · Georgia law
What O.C.G.A. 10-1-912 requires, who it actually covers, and the seven things Atlanta businesses should prepare before a breach. General information, not legal advice.
Notice without unreasonable delay
24-hour rule for data vendors
Seven things to prepare now
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
Georgia’s data breach notification law is found at O.C.G.A. sections 10-1-910 to 10-1-912. It requires notice to Georgia residents “in the most expedient time possible and without unreasonable delay” when their unencrypted personal information is, or is reasonably believed to have been, acquired by an unauthorized person. There is no fixed number of days. A company that maintains data for someone else must tell the data owner within 24 hours of discovering a breach. If more than 10,000 Georgia residents are notified, the nationwide credit bureaus must be told as well.
One detail surprises most Atlanta owners: the statute is written for “information brokers” and government “data collectors,” not every business. That does not mean ordinary companies are off the hook, for reasons covered below. This article is general information, not legal advice. Confirm your obligations with a privacy lawyer and your cyber insurer.
The law defines three groups:
Read literally, a dental practice, law firm or distributor in Atlanta is usually not an information broker. Some summaries describe the law more broadly, and courts and regulators can read it differently, so do not decide your coverage alone. Ask counsel.
Even if the Georgia statute does not name you, a breach can still create legal duties and costs.
The statute covers a first name or first initial and last name combined with any of these, when the data is not encrypted or redacted:
Any of those items without a name also counts if it would be enough to attempt identity theft. Only electronic data is covered. Georgia has no separate risk-of-harm test, so once the conditions are met, notice is expected.
Notice can be written, by phone or electronic, if electronic notice meets federal e-signature rules. Substitute notice, such as a website posting and media notice, is allowed in limited cases like very large breaches or missing contact details. Notice can be delayed if law enforcement determines it would compromise a criminal investigation.
Georgia does not require notice to the Attorney General or any state agency under the general statute, and it does not create a private right of action or set fines. The practical risk comes from the other sources listed above, not from the statute’s penalty clause.
Want a clear picture of your exposure before something happens? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report on your cybersecurity, IT operations and business continuity, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
“Most expedient time possible” leaves no room for building a plan after the fact. These are the pieces Atlanta businesses should have ready.
List every place personal information lives: Microsoft 365 or Google Workspace mailboxes, file shares, payroll, your CRM, accounting software, scanned IDs and old exports. Note which states the people live in. That list decides which laws apply.
Write down who calls whom in the first hour: your breach lawyer, your cyber insurer’s claims line, your IT provider, your bank and the person who talks to staff. Check the policy for an approved vendor panel. Using an outside firm without the insurer’s consent can cause coverage trouble.
Investigators need sign-in records, mailbox audit logs and file access history to say what was touched. Confirm that audit logging is on and how many days it is kept. Short retention is a common reason a small breach turns into notifying everyone.
Encrypted data is outside Georgia’s definition. Turn on full-disk encryption on every laptop and require it on phones that receive company email.
Ask payroll, IT, billing and cloud vendors how fast they will report an incident to you. Georgia’s 24-hour rule for maintainers is a good standard to write into contracts.
Draft individual and regulator notice templates with counsel now. Fill in facts later.
Once a year, spend an hour walking through a scenario, such as a stolen laptop or a hijacked mailbox, and see where the plan breaks.
Most cyber insurance applications ask about the same items. We cover that list in our guide to cyber insurance requirements in 2026.
JLB USA provides cybersecurity services in Atlanta for businesses with roughly 25 to 100 employees: MFA, access reviews, same-day removal of leavers, endpoint protection, updates, encryption, email security, monitored backups with tested restores and a written recovery plan. We also help with cyber-insurance questionnaires. On-site support is available in Atlanta, and we reply within 5 minutes by email or phone. If you need day-to-day IT as well, see our managed IT services in Atlanta.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Georgia’s statute sets no fixed number of days. Notice must be made in the most expedient time possible and without unreasonable delay, allowing time to determine the scope and restore security. Vendors that hold data for a covered party must notify it within 24 hours.
The statute is written for information brokers, government data collectors and the vendors that hold their data. Many ordinary businesses fall outside that wording, but other states’ laws, federal rules, contracts and lawsuits can still apply. Confirm with counsel.
Not under the general breach statute. You must notify the nationwide credit bureaus if more than 10,000 Georgia residents are notified. Other laws, such as HIPAA or the FTC Safeguards Rule, may require reports to federal agencies.
No. The statute applies to unencrypted or unredacted personal information, which is why full-disk encryption on laptops and phones is one of the most valuable controls you can have.
The statute itself does not create a private right of action, but in Collins v. Athens Orthopedic Clinic (2019) the Supreme Court of Georgia allowed negligence claims by people whose stolen data was offered for sale. This is general information, not legal advice.
