Which privacy laws apply to your business in Georgia?
Georgia has no comprehensive consumer-privacy law. The generally applicable state framework has two pieces: the Identity Theft article, which requires breach notice by an information broker or data collector that maintains computerized personal information , and the Georgia Fair Business Practices Act (FBPA), which declares unfair or deceptive practices in consumer transactions and consumer acts or practices in trade or commerce unlawful . Neither statute gives Georgia residents general rights to access, delete, correct, or opt out of sale or targeted advertising.
The breach article is narrower than many states' breach laws. It covers an information broker — a person or entity that, for fees or dues, is in the business of collecting and furnishing personal information to nonaffiliated third parties — and a data collector, which Georgia defines as a state or local government agency or subdivision, with several public-record and law-enforcement carve-outs . Ordinary businesses that do not fit the information-broker definition can still be affected as vendors, because a person or business maintaining covered computerized data on behalf of an information broker or data collector must notify that owner within 24 hours after discovery of a breach .
The FBPA is the state-law backstop for consumer-facing privacy promises. Its purpose is to protect consumers and legitimate businesses from unfair or deceptive practices in trade or commerce in Georgia, and the General Assembly directs courts to construe it consistently with federal-court interpretations of FTC Act § 5 . That makes a public privacy policy a real legal artifact even though Georgia does not prescribe a privacy-policy template: if the policy misstates how the business collects, uses, shares, secures, or retains data, the theory is deception rather than violation of an omnibus privacy code.
The rest of the program rides federal and sectoral law. FTC Act § 5 reaches deceptive or unfair privacy practices nationwide; GLBA governs financial institutions; HIPAA governs covered health entities and their business associates; COPPA governs services directed to children under 13; and other states' comprehensive laws can apply to a Georgia business that meets their thresholds.
Sources for this answer
Primary law
A.1 O.C.G.A. § 10-1-912Georgia's breach-notification duty applies to an information broker or data collector that maintains computerized data including personal information of individuals.
Any information broker or data collector that maintains computerized data that includes personal information of individuals shall give notice of any breach of the security of the system following discovery or notification of the breach in the security of the data to any resident of this state whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
See O.C.G.A. § 10-1-912(a).
Primary law
A.2 O.C.G.A. § 10-1-393The Georgia FBPA declares unfair or deceptive acts or practices in consumer transactions and consumer acts or practices in trade or commerce unlawful.
Unfair or deceptive acts or practices in the conduct of consumer transactions and consumer acts or practices in trade or commerce are declared unlawful.
See O.C.G.A. § 10-1-393(a).
Primary law
A.3 O.C.G.A. § 10-1-911Georgia defines a data collector as a state or local government agency or subdivision, and an information broker as a fee-based business furnishing personal information to nonaffiliated third parties.
“Information broker” means any person or entity who, for monetary fees or dues, engages in whole or in part in the business of collecting, assembling, evaluating, compiling, reporting, transmitting, transferring, or communicating information concerning individuals for the primary purpose of furnishing personal information to nonaffiliated third parties
See O.C.G.A. § 10-1-911(2)-(3).
Primary law
A.4 O.C.G.A. § 10-1-912A vendor maintaining covered computerized data it does not own must notify the information broker or data collector within 24 hours after discovering a breach involving unauthorized acquisition or reasonably believed acquisition.
Any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of individuals that the person or business does not own shall notify the information broker or data collector of any breach of the security of the system within 24 hours following discovery
See O.C.G.A. § 10-1-912(b).
Primary law
A.5 O.C.G.A. § 10-1-391The FBPA is intended to protect consumers and legitimate businesses from unfair or deceptive practices and is construed consistently with federal-court interpretations of FTC Act § 5.
The purpose of this part shall be to protect consumers and legitimate business enterprises from unfair or deceptive practices in the conduct of any trade or commerce in part or wholly in the state.
See O.C.G.A. § 10-1-391(a)-(b).
What must your Georgia privacy policy contain?
No Georgia statute generally requires a consumer privacy policy or fixes what it must say. The binding rule is consistency: the FBPA prohibits unfair or deceptive practices in consumer transactions , and the statute is construed consistently with FTC Act § 5 . A policy that misstates actual data practices is therefore exposed as a deceptive-practices problem under Georgia and federal law, even though Georgia has no omnibus privacy-policy checklist.
In practice, build the Georgia policy from the regimes that actually bind the business. A financial institution may not disclose nonpublic personal information to nonaffiliated third parties unless it has provided the consumer a GLBA-compliant privacy notice . A HIPAA covered entity must give individuals notice of permitted uses and disclosures, rights, and the entity's legal duties . COPPA bars an operator of a child-directed site or service, or an operator with actual knowledge it collects children's personal information, from collecting that information in violation of the FTC's notice and parental-consent rules .
For everyone else, Georgia does not supply an itemized state notice list. Use a best-practice policy — categories of personal information collected, purposes, categories of third parties, retention, security, consumer choices, and contact methods — because other states may require those contents and because the enforceable Georgia question is whether the statement matches the conduct. Do not promise deletion, opt-out, sale limits, geolocation limits, or retention schedules unless the operating program can honor them.
In Georgia, the absence of an omnibus privacy-policy statute is not permission to publish loose language. The FBPA reaches deception in the consumer marketplace, and the General Assembly expressly tied its construction to FTC Act § 5; treat every privacy-policy sentence as a representation that operations must support .
Sources for this answer
Primary law
B.1 O.C.G.A. § 10-1-393The FBPA declares unfair or deceptive acts or practices in consumer transactions and consumer acts or practices in trade or commerce unlawful.
Unfair or deceptive acts or practices in the conduct of consumer transactions and consumer acts or practices in trade or commerce are declared unlawful.
See O.C.G.A. § 10-1-393(a).
Primary law
B.2 O.C.G.A. § 10-1-391Georgia directs the FBPA to be interpreted consistently with federal-court interpretations of FTC Act § 5.
It is the intent of the General Assembly that this part be interpreted and construed consistently with interpretations given by the Federal Trade Commission in the federal courts pursuant to Section 5(a)(1) of the Federal Trade Commission Act (15 U.S.C. Section 45(a)(1)), as from time to time amended.
See O.C.G.A. § 10-1-391(b).
Primary law
B.3 GLBA privacy noticeA GLBA financial institution may not disclose nonpublic personal information to a nonaffiliated third party unless it has provided the consumer a compliant privacy notice.
a financial institution may not, directly or through any affiliate, disclose to a nonaffiliated third party any nonpublic personal information, unless such financial institution provides or has provided to the consumer a notice that complies with section 6803 of this title.
See 15 U.S.C. § 6802(a).
Primary law
B.4 HIPAA Notice of Privacy PracticesA HIPAA covered entity must give individuals a notice describing uses and disclosures of protected health information, individual rights, and the entity's legal duties.
an individual has a right to adequate notice of the uses and disclosures of protected health information that may be made by the covered entity, and of the individual's rights and the covered entity's legal duties with respect to protected health information
See 45 C.F.R. § 164.520(a)(1).
Primary law
B.5 COPPACOPPA prohibits covered operators from collecting children's personal information in violation of the FTC's notice and parental-consent regulations.
It is unlawful for an operator of a website or online service directed to children, or any operator that has actual knowledge that it is collecting personal information from a child, to collect personal information from a child in a manner that violates the regulations prescribed under subsection (b).
See 15 U.S.C. § 6502(a)(1).
What must your contracts with vendors say?
Georgia has no general data-processing-agreement statute. It does not prescribe controller-to-processor instructions, audit rights, deletion clauses, or subprocessor flow-downs for ordinary privacy vendors. The Georgia-specific vendor duty is narrow but fast: a person or business maintaining covered computerized personal information on behalf of an information broker or data collector must notify that owner within 24 hours after discovering a breach, if the personal information was or is reasonably believed to have been acquired by an unauthorized person .
That 24-hour rule is the term to hard-wire into Georgia-facing vendor agreements. The statute gives the vendor a statutory notice-up duty, but the contract should supply the mechanics: who receives notice, what counts as discovery, what facts must be included, how quickly forensic updates follow, who sends resident notices, who notifies consumer reporting agencies if the incident exceeds 10,000 Georgia residents, and who pays response costs.
Where a federal or sectoral regime applies, it supplies the fuller contract terms. The GLBA Safeguards Rule requires financial institutions to oversee service providers by selecting capable providers, requiring safeguards by contract, and periodically assessing them . HIPAA requires a written business-associate agreement before protected health information is shared, including permitted uses and disclosures and downstream protections . Outside those regimes, use the multistate best-practice clauses anyway: processing limited to documented instructions, confidentiality, reasonable security, breach notice back to your business on a short clock, cooperation with notices and investigations, and return or deletion at the end of the engagement.
Sources for this answer
Primary law
C.1 O.C.G.A. § 10-1-912A vendor maintaining covered computerized data it does not own must notify the information broker or data collector within 24 hours after discovering a breach involving unauthorized acquisition or reasonably believed acquisition.
Any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of individuals that the person or business does not own shall notify the information broker or data collector of any breach of the security of the system within 24 hours following discovery, if the personal information was, or is reasonably believed to have been, acquired by an unauthorized person.
See O.C.G.A. § 10-1-912(b).
Primary law
C.2 GLBA Safeguards RuleThe GLBA Safeguards Rule requires a financial institution to oversee its service providers — selecting capable providers, requiring safeguards by contract, and periodically assessing them.
Oversee service providers, by: (1) Taking reasonable steps to select and retain service providers that are capable of maintaining appropriate safeguards for the customer information at issue; (2) Requiring your service providers by contract to implement and maintain such safeguards; and (3) Periodically assessing your service providers based on the risk they present and the continued adequacy of their safeguards.
See 16 C.F.R. § 314.4(f).
Primary law
C.3 HIPAA Business Associate ContractsHIPAA requires a written business-associate contract that establishes the permitted and required uses and disclosures of protected health information by the business associate.
A contract between the covered entity and a business associate must: (i) Establish the permitted and required uses and disclosures of protected health information by the business associate.
See 45 C.F.R. § 164.504(e)(2).
When must you notify people of a data breach in Georgia?
For covered information brokers and data collectors, notice must go to each affected Georgia resident in the most expedient time possible and without unreasonable delay after discovery or notification of a breach, subject to law-enforcement delay and time needed to determine scope and restore reasonable system integrity . Georgia sets no fixed outer day-count for resident notice, but vendors maintaining covered data they do not own have a hard 24-hour notice-up clock to the information broker or data collector .
Georgia's trigger is acquisition-based. A breach of the security of the system means unauthorized acquisition of electronic data that compromises the security, confidentiality, or integrity of personal information; good-faith employee or agent acquisition or use is excluded if it is not used or further disclosed without authorization . The resident notice duty applies when unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person .
The 2024 amendment to the definition of personal information matters. Georgia still covers first name or first initial and last name combined with an unencrypted or unredacted Social Security number, driver's license or state ID number, account or payment-card number usable without additional credentials, account passwords, PINs, or access codes . But it also now covers those same identity-theft-enabling items even when they are not connected to the person's name, if the compromised information would be sufficient to perform or attempt identity theft . Publicly available government-record information is excluded.
Notice methods include written, telephone, and E-SIGN-consistent electronic notice. Substitute notice is available only if the cost exceeds $50,000, the affected class exceeds 100,000, or the business lacks sufficient contact information; substitute notice requires all three components: email where available, conspicuous website posting where the broker or collector maintains a website, and notice to major statewide media . If more than 10,000 Georgia residents must be notified at one time, the information broker or data collector must also notify all nationwide consumer reporting agencies without unreasonable delay about the timing, distribution, and content of the notices .
There is no general Georgia Attorney General notice threshold in these captured sections. The Georgia-specific incident-response routing is therefore resident notice, 24-hour vendor notice-up, law-enforcement delay where applicable, and nationwide consumer-reporting-agency notice for incidents over 10,000 residents.
The 24-hour vendor clock is shorter than many standard incident-response clauses. For Georgia-covered data, a contract that gives a vendor three, five, or ten business days to report a breach can be too slow for the statutory notice-up duty .
Sources for this answer
Primary law
D.1 O.C.G.A. § 10-1-912A covered information broker or data collector must notify affected Georgia residents in the most expedient time possible and without unreasonable delay after discovery or notification of a breach involving unencrypted personal information.
The notice shall be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement, as provided in subsection (c) of this Code section, or with any measures necessary to determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system.
See O.C.G.A. § 10-1-912(a).
Primary law
D.2 O.C.G.A. § 10-1-912A vendor maintaining covered computerized data it does not own must notify the information broker or data collector within 24 hours after discovering a breach involving unauthorized acquisition or reasonably believed acquisition.
Any person or business that maintains computerized data on behalf of an information broker or data collector that includes personal information of individuals that the person or business does not own shall notify the information broker or data collector of any breach of the security of the system within 24 hours following discovery
See O.C.G.A. § 10-1-912(b).
Primary law
D.3 O.C.G.A. § 10-1-911Georgia defines breach of security as unauthorized acquisition of electronic data that compromises personal information, with a good-faith employee or agent exception if the information is not used or further disclosed without authorization.
“Breach of the security of the system” means unauthorized acquisition of an individual’s electronic data that compromises the security, confidentiality, or integrity of personal information of such individual maintained by an information broker or data collector.
See O.C.G.A. § 10-1-911(1).
Primary law
D.4 O.C.G.A. § 10-1-911Georgia personal information includes a name linked to unencrypted or unredacted Social Security number, driver's license or state ID number, account or payment-card number usable without more, account passwords, PINs, or access codes.
“Personal information” means an individual’s first name or first initial and last name in combination with any one or more of the following data elements, when either the name or the data elements are not encrypted or redacted
See O.C.G.A. § 10-1-911(6)(A)-(D).
Primary law
D.5 O.C.G.A. § 10-1-911Georgia also treats the listed identity-theft-enabling elements as personal information without a name if the compromised information would be sufficient to perform or attempt identity theft.
Any of the items contained in subparagraphs (A) through (D) of this paragraph when not in connection with the individual’s first name or first initial and last name, if the information compromised would be sufficient to perform or attempt to perform identity theft against the person whose information was compromised.
See O.C.G.A. § 10-1-911(6)(E).
Primary law
D.6 O.C.G.A. § 10-1-911Georgia permits written, telephone, electronic, or substitute notice; substitute notice is available when cost exceeds $50,000, the affected class exceeds 100,000, or contact information is insufficient, and requires email where available, website posting where available, and major statewide media.
Substitute notice, if the information broker or data collector demonstrates that the cost of providing notice would exceed $50,000.00, that the affected class of individuals to be notified exceeds 100,000, or that the information broker or data collector does not have sufficient contact information to provide written or electronic notice to such individuals.
See O.C.G.A. § 10-1-911(4).
Primary law
D.7 O.C.G.A. § 10-1-912When notice is required for more than 10,000 Georgia residents at one time, the information broker or data collector must also notify nationwide consumer reporting agencies without unreasonable delay.
In the event that an information broker or data collector discovers circumstances requiring notification pursuant to this Code section of more than 10,000 residents of this state at one time, the information broker or data collector shall also notify, without unreasonable delay, all consumer reporting agencies that compile and maintain files on consumers on a nation-wide basis
See O.C.G.A. § 10-1-912(d).
Can a consumer sue your business in Georgia over privacy?
The breach-notification article captured here does not create an express private right of action. The private-suit path is the FBPA: a person injured by consumer acts or practices in violation of the FBPA may bring an individual action, but not a representative action, for equitable injunctive relief and general and exemplary damages . Before filing, the claimant generally must send a written demand at least 30 days in advance identifying the unfair or deceptive practice and the injury suffered .
The FBPA remedy can be meaningful where a privacy theory fits the statute. A court must award three times actual damages for an intentional violation , and if the court finds an FBPA violation, the injured person is awarded reasonable attorney's fees and litigation expenses, subject to the statute's rejected-settlement limitations and bad-faith rules . The Attorney General must also be served with the initial complaint and amended complaints within 20 days after filing, and may be heard in the action .
The constraint is scope. The FBPA reaches unfair or deceptive practices in consumer transactions and consumer acts or practices in trade or commerce . A privacy-policy misrepresentation in a consumer-facing service is the natural Georgia theory; a purely internal employment-data issue, a one-off private dispute, or an incident outside the consumer marketplace is a harder fit. For data-breach-only claims, Georgia's identity-theft article supplies the notice standard, but not an express damages remedy in these sections.
Sources for this answer
Primary law
E.1 O.C.G.A. § 10-1-399The FBPA authorizes an injured person to bring an individual, but not representative, action for equitable injunctive relief and general and exemplary damages.
any person who suffers injury or damages as a result of a violation of Chapter 5B of this title, as a result of consumer acts or practices in violation of this part, as a result of office supply transactions in violation of this part or whose business or property has been injured or damaged as a result of such violations may bring an action individually, but not in a representative capacity
See O.C.G.A. § 10-1-399(a).
Primary law
E.2 O.C.G.A. § 10-1-399A claimant generally must deliver a written demand for relief at least 30 days before filing an FBPA action.
At least 30 days prior to the filing of any such action, a written demand for relief, identifying the claimant and reasonably describing the unfair or deceptive act or practice relied upon and the injury suffered, shall be delivered to any prospective respondent.
See O.C.G.A. § 10-1-399(b).
Primary law
E.3 O.C.G.A. § 10-1-399Subject to the demand-and-tender subsection, a court must award three times actual damages for an intentional FBPA violation.
Subject to subsection (b) of this Code section, a court shall award three times actual damages for an intentional violation.
See O.C.G.A. § 10-1-399(c).
Primary law
E.4 O.C.G.A. § 10-1-399If the court finds an FBPA violation, the injured person receives reasonable attorney's fees and litigation expenses, subject to the statute's settlement and bad-faith limitations.
If the court finds in any action that there has been a violation of this part, the person injured by such violation shall, in addition to other relief provided for in this Code section and irrespective of the amount in controversy, be awarded reasonable attorneys’ fees and expenses of litigation incurred in connection with said action
See O.C.G.A. § 10-1-399(d).
Primary law
E.5 O.C.G.A. § 10-1-399The Attorney General must be served with the initial complaint and amended complaints in an FBPA action within 20 days after filing and is entitled to be heard.
In any action brought under this Code section the Attorney General shall be served by certified or registered mail or statutory overnight delivery with a copy of the initial complaint and any amended complaint within 20 days of the filing of such complaint.
See O.C.G.A. § 10-1-399(g).
Primary law
E.6 O.C.G.A. § 10-1-393The FBPA's underlying prohibition is limited to unfair or deceptive practices in consumer transactions and consumer acts or practices in trade or commerce.
Unfair or deceptive acts or practices in the conduct of consumer transactions and consumer acts or practices in trade or commerce are declared unlawful.
See O.C.G.A. § 10-1-393(a).