United States law applies in GeorgiaGeorgia is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of Georgia, described on this page below, applies here too.
10 of 11 named instruments researched to a stage, across five of the ten areas of law we track: 7 in force, 2 not yet in force and 1 blocked by a court. As of .
When each starts8 of 10 carry a date, 2 do not. Earlier is before 2015.
in forcenot yet in forceblocked by a courtproposedno longer in force
Georgia has no comprehensive AI risk-management statute; its AI-specific enactments are narrow and sector-specific.
Senate Bill 540 was enacted as 2026 Ga. Laws Act 518, signed and effective , adding O.C.G.A. § 39-5-6 to Title 39, Chapter 5 to regulate 'AI companion chatbots' with disclosure, minor-protection, crisis-response, and age-assurance duties enforced by the Attorney General; the enacted text is narrower than an earlier committee substitute that would have reached 'conversational AI services' generally.
Senate Bill 444 (2025-2026 session), published by the Governor's office among Georgia's 2026 signed legislation, adds O.C.G.A. § 33-46-7.1 to the private review agent certification chapter: a private review agent or utilization review entity may use artificial intelligence in a utilization review, but the system may not issue an adverse coverage determination until a natural person qualifying as a private review agent, with a clinical peer participating, has reviewed it; the Act's own text sets its effective date as .
Georgia has not enacted a general AI risk-obligations, training-data-transparency, or algorithmic-discrimination statute.
Not yet in force.from ,in 2 months It starts to bind on .
Binds private bodies.
What this law does
SB 444, as passed by the General Assembly, adds O.C.G.A. § 33-46-7.1 to the private-review-agent certification chapter of the insurance code.
A private review agent or utilization review entity may use an artificial intelligence system or other software tool as part of a utilization review plan meeting the Insurance Commissioner's standards, but such a system may not issue an adverse coverage determination for healthcare services until a natural person qualifying as a private review agent or utilization review entity conducts the review with a clinical peer participating, and the system may never supersede that clinical peer's judgment. The Act sets its own effective date of .
Not yet in force.from ,in 8 months It starts to bind on .
Binds public and private bodies.
What this law does
SB 540, enacted as 2026 Ga. Laws Act 518, adds Code Section 39-5-6 to Title 39, Chapter 5 to govern 'AI companion chatbots,' systems using artificial intelligence or emotional-recognition algorithms designed to simulate a sustained human-like relationship by retaining information across sessions, asking unprompted emotion-based questions, and sustaining an ongoing personal dialogue; the definition excludes an internal-use or productivity-focused generative AI system, an ordinary customer-service chatbot, a voice-activated device assistant, a narrow educational tool, and a video-game or entertainment character restricted to its own subject matter.
An operator must disclose that a user is interacting with an AI companion chatbot at the start of each session and at least every three hours, or every hour where the operator knows or should know the user is a minor, and for a known minor must take reasonable measures against the chatbot claiming sentience, producing sexually explicit content, simulating a romantic relationship, encouraging secrecy or isolation from a trusted adult, or using engagement techniques designed to prolong attachment.
An operator must adopt and publicly disclose a protocol for detecting and responding to expressions of severe harm, including self-harm and suicidal ideation, with referral to crisis resources and an annual public count of referrals, and for accounts known to belong to minors must offer tools to manage privacy, notifications, and safety settings and use a commercially reasonable, privacy-protective age-assurance method before granting access to any feature that could generate sexually explicit synthetic content.
The Attorney General enforces the section, with a civil penalty of up to $10,000 per knowing violation (each day counted separately for each affected user), plus damages, fees, and injunctive relief, and discretion to allow a 30-day cure period for a first-time non-knowing violation; a hosting provider, app store, or search engine is not liable solely for providing access absent direct operation or control of the chatbot.
The Act was signed and takes effect ; an earlier committee substitute would instead have reached 'conversational AI services' generally, a broader and differently defined category than the AI companion chatbot the enacted text regulates.
Georgia has no comprehensive consumer-privacy statute. A genuine comprehensive bill, SB 111 (2026), titled the Georgia Consumer Privacy Protection Act, passed the Senate, but the House replaced its entire text with unrelated rural-hospital tax-credit provisions before Governor Kemp signed the substituted bill on , so no privacy law was actually enacted under that number.
Georgia's operative privacy statute is the narrow Georgia Personal Identity Protection Act, O.C.G.A. Secs. 10-1-910 to 10-1-915, a breach notification and identity-theft statute whose notice duty binds information brokers and state or local agencies.
Its personal information definition combines a name with a Social Security number, driver's license or state ID number, or an account, credit card, or debit card number, and also reaches account passwords and other access codes; it names no biometric, genetic, or health category and grants no general data-subject rights; Georgia courts have held the Act creates no freestanding data-security duty.
The identity-theft statute itself creates no private right of action, but Georgia's general Fair Business Practices Act separately arms a person injured by a deceptive trade practice with an individual civil action for injunctive relief and damages.
O.C.G.A. Sec. 10-1-912Georgia General Assembly, text of Senate Bill 236 (2007 Regular Session) as passed, which revised O.C.G.A. Sec. 10-1-911 and 10-1-912
An information broker or data collector, a term the Act defines to cover a state or local government agency or subdivision, that maintains computerized personal information on a Georgia resident must give notice of a breach of the security of the system in the most expedient time possible and without unreasonable delay, unless a law enforcement agency determines notification would compromise a criminal investigation.
A person or business maintaining data on behalf of an information broker or data collector must notify that broker or collector of a breach of the security of the system within 24 hours following discovery, and above a 10,000-resident notification threshold the notifying party must also notify nationwide consumer reporting agencies.
Georgia's personal information definition, in Code section 10-1-911, covers an individual's name combined with a Social Security number, a driver's license or state identification card number, an account, credit card, or debit card number where it could be used without additional identifying information, access codes, or passwords, or an account password, personal identification number or other access code, and also covers any of those elements without the name if the information would suffice for identity theft; biometric, genetic, and health data are absent from the definition entirely, so a breach of biometric data alone triggers no notice duty.
The Act has no direct notice duty running to a state regulator or the Attorney General, and Georgia courts have held the Act imposes no freestanding data-security standard of conduct in its own right. The provisions this entry describes came into force on different days.
O.C.G.A. Sec. 10-1-399official Code of Georgia Annotated text, hosted by the Georgia Attorney General's Consumer Protection Division
In force since .Binds private bodies.
What this law does
Any person who suffers injury or damage from a consumer act or practice that violates the Georgia Fair Business Practices Act may bring an individual civil action, though not a class action, to obtain equitable injunctive relief and to recover general and exemplary damages, with exemplary damages available only for an intentional violation and the court awarding three times actual damages for an intentional violation.
A prevailing injured party is also entitled to reasonable attorneys' fees and expenses of litigation, though fees incurred after rejecting a reasonable written settlement offer within 30 days of the required pre-suit demand are excluded, and fees shift against a plaintiff who continues an action after such a rejection in bad faith or to harass.
This private right of action is separate from, and broader in subject matter than, the Personal Identity Protection Act's breach-notification duty, which itself creates no private right of action. The Fair Business Practices Act of 1975, which first enacted this remedy, took effect on its approval by the Governor on .
Georgia diverges from the federal baseline through its own Computer Systems Protection Act, O.C.G.A. § 16-9-93, which criminalizes computer theft, computer trespass, computer invasion of privacy, computer forgery, and computer password disclosure whenever committed 'without authority,' a term the Act defines to include use that 'exceeds any right or permission granted by the owner of the computer or computer network.'
Unlike Virginia's narrower malicious-intent standard, Georgia's authorization test tracks the federal Computer Fraud and Abuse Act's own exceeds-authorized-access language, so ordinary unauthenticated access to a public page that grants and denies no permission at all does not, on its own text, satisfy the statute's authorization element, though no Georgia court decision applying the Act to a scraping or automated-collection fact pattern specifically was located.
The Act arms a private civil action for damages alongside its felony-level criminal penalties. A companion provision in the same article, O.C.G.A. § 16-9-93.1, separately criminalizes using a computer network to falsely identify oneself as another person, organization, or trademark holder (misappropriation of computer identity), a spoofing offense rather than one reaching automated collection of public data.
Copyright, text-and-data-mining, and database rights are federal only; Georgia adds nothing there. Terms-of-service enforceability rests on ordinary Georgia contract law, and no Georgia-specific browsewrap or clickwrap precedent was located. robots.txt carries no independent legal weight under Georgia law. Georgia has no comprehensive privacy statute reaching scraped public personal data; see this jurisdiction's privacy topic document for the narrow breach-notification statute that does exist.
O.C.G.A. § 16-9-93Georgia Code Title 16, Crimes and Offenses, FindLaw's copy of the official text (codes.findlaw.com), current as of
In force.Binds public and private bodies.
What this law does
Section 16-9-93 makes it a crime, whenever committed without authority, to take or appropriate another's property using a computer (computer theft), to delete, obstruct, or damage computer data, programs, or operation (computer trespass), to examine another person's employment, medical, salary, credit, or other financial or personal data (computer invasion of privacy), to create, alter, or delete data in a way that would be forgery if done on paper (computer forgery), or to disclose a password or access code resulting in damages over $500 (computer password disclosure).
'Without authority' is defined at Section 16-9-92(18) to include use that exceeds any right or permission the computer's owner granted, a test closer to the federal Computer Fraud and Abuse Act's exceeds-authorized-access standard than to Virginia's added malicious-intent or deceptive-means requirement. Subsection (g) grants any person injured by a violation a civil action for damages and costs, not limited to the criminal remedy, with a four-year discovery-based limitations period.
Subsection (f) is a general savings clause preserving the applicability of any other law that presently applies or may apply to the same conduct; it does not name contract law specifically. The section's history note names the act that enacted it, and the codified text does not state the day on which the section came into force.
Georgia's private-sector security-topic footprint is narrow: one enacted state statute imposes a genuine record-disposal duty distinct from breach notification, no enacted state law sets market-entry security requirements for a connected device or software product, no state law creates a general private-sector duty to report a vulnerability or a security incident to an authority, and no state regime was located adopting the newer NAIC Insurance Data Security Model Law.
O.C.G.A. Sec. 10-15-2 (Title 10, Commerce and Trade), part of a chapter (O.C.G.A. Secs. 10-15-1 to 10-15-7) that already had at least one provision in force by (the same chapter's receipt-truncation section, O.C.G.A. Sec. 10-15-3(b)(1), states that date for its own first phase-in; the disposal duty's own commencement date is not stated in the unannotated code text consulted here), requires a 'business,' defined broadly to include a sole proprietorship, partnership, corporation, association, or other group organized for profit or not, and expressly including a financial institution and an entity that destroys records, to shred, erase, modify to make unreadable, or otherwise take reasonable action to prevent unauthorized access to a customer's record before discarding it, where that record combines personally identifiable data with a customer's medical condition, an account or credit balance, information supplied when opening an account or applying for a loan or credit, or a federal, state, or local income tax return.
The duty carves out a bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security provisions, and any other entity governed by a federal law that itself requires disposal of such records in the same manner.
The same chapter's O.C.G.A. Sec. 10-15-3 requires a merchant accepting a payment card to truncate the account number and omit the expiration date on a printed receipt, phased in from for machines first used on or after that date to for all machines; because that duty binds a merchant printing a payment receipt rather than a duty over a software product's security posture or a business's general handling of covered information, and because it substantially overlaps the federal Fair and Accurate Credit Transactions Act's own truncation requirement, it is named here rather than filed as its own instrument.
The same chapter's O.C.G.A. Sec. 10-15-4, which makes it a crime for a person to use a scanning device or reencoder to capture or transfer payment-card magnetic-strip data with intent to defraud, and O.C.G.A. Sec. 10-15-7's felony penalties for that offense (one to three years' imprisonment or a fine of up to $10,000.00 for a first offense, three to ten years or up to $50,000.00 for a second or subsequent offense), bind the intruder who captures the data rather than the system's operator or manufacturer, so both sit with the scraping topic's computer-misuse family rather than here.
O.C.G.A. Sec. 10-15-5 authorizes the Attorney General to enforce the chapter using the Fair Business Practices Act's investigative powers, and O.C.G.A. Sec. 10-15-6 caps an administrative penalty for a violation of the disposal duty at $500.00 per wrongfully discarded customer record with a $10,000.00 total ceiling per order, subject to an affirmative due-diligence defense, with hearings and judicial review under the Georgia Administrative Procedure Act; the chapter states no private right of action of its own.
No enacted Georgia statute was located that sets security requirements a connected device or software product must meet before or after it reaches the market, comparable to California's or Oregon's connected-device statutes or the Cyber Resilience Act, and outside O.C.G.A. 38-3-22.2, whose reporting duties on agencies and on utilities are filed as rows of their own, no enacted Georgia statute creates a private-sector duty to report an exploited vulnerability or a security incident to a state authority; both are researched absences rather than gaps in coverage.
Georgia's Insurance Code, Title 33, carries a chapter on insurers' collection, use, and disclosure of information (O.C.G.A. Secs. 33-39-1 et seq., the older NAIC Insurance Information and Privacy Protection Act model, itself a privacy-topic matter), but the full Title 33 chapter listing read here, dated by its publisher to and running from Chapter 1 through Chapter 65, carries no chapter addressing an insurer's or insurance licensee's information-security program, a cybersecurity event, or a data-security duty comparable to the newer NAIC Insurance Data Security Model Law already adopted in South Carolina, Hawaii, Alaska, Arizona, and Wisconsin, and the Georgia Department of Insurance and Safety Fire Commissioner's own website carries no reference to a data-security or cybersecurity regulatory program either.
A 2025 or 2026 session enactment of the newer model law is not confirmed in the primary text consulted here: the Georgia General Assembly's own legislation-search site, www.legis.ga.gov, serves only a JavaScript application that returned no readable statute text, so a very recent adoption cannot be fully ruled out from the sources read here.
The Georgia Technology Authority (O.C.G.A. Title 50, Chapter 25) has the statutory power 'to establish technology security policies, standards, and services to be used by all agencies' (O.C.G.A. Sec. 50-25-4(a)(20)); nothing in the section read here extends that duty to a vendor or contractor doing business with the state, so it is a government's own information-security programme rather than a duty this topic tracks, and it is not filed as an instrument here.
Georgia's breach-notification statute, the Georgia Personal Identity Protection Act (O.C.G.A. Secs. 10-1-910 to 10-1-915), is already this jurisdiction's privacy-topic row rather than repeated here, and the Georgia Computer Systems Protection Act's hacking, computer theft, trespass, invasion-of-privacy, forgery, and password-disclosure offenses (O.C.G.A. Sec. 16-9-90 et seq.) bind an intruder rather than a system's operator and belong to the scraping topic.
Section 38-3-22.2 of the Official Code of Georgia Annotated requires every agency to report to the director of emergency management and homeland security a qualifying cyber attack incident, data breach, or identified use of malware. The same section requires every utility to report to the director of emergency management and homeland security a cyber attack incident, data breach, or identified use of malware that it must report to the United States government.
O.C.G.A. Sec. 10-15-2Official text of Senate Bill 148 as passed (2015-2016 Regular Session, Act 187)
In force since .Binds private bodies.
What this law does
A 'business' may not discard or dispose of a customer's record containing personal information unless it shreds the record, erases the personal information, modifies the record to make the personal information unreadable, or takes other action it reasonably believes will ensure that no unauthorized person will have access to the personal information for the period between disposal and destruction.
'Business' is defined broadly (sole proprietorship, partnership, corporation, association, or other group, organized for profit or not), expressly includes a financial institution and an entity that destroys records, and excludes a bank or financial institution subject to the Gramm-Leach-Bliley Act's privacy and security provisions, a hospital or health care institution subject to Health Insurance Portability and Accountability Act (HIPAA)'s privacy and security provisions, and any other entity governed by a federal law that itself requires disposal of such records in the same manner.
'Personal information' is personally identifiable data about a customer's medical condition, account or credit balance or limit, data supplied when opening an account or applying for a loan or credit, or a federal, state, or local income tax return, where 'personally identifiable' requires the data to be combined with an identifier such as a Social Security number, driver identification number, passport number, or date of birth; a name, address, or phone number alone is not personally identifiable data under this chapter.
The Attorney General enforces the duty using the Fair Business Practices Act's investigative powers, and may impose an administrative penalty of not more than $500.00 for each wrongfully discarded customer record, capped at $10,000.00 total per order, after notice and a hearing conducted under the Georgia Administrative Procedure Act; a business that shows it used due diligence in its attempt to properly dispose of the record has an affirmative defense. The chapter states no private right of action for a violation of this duty.
Section 38-3-22.2(b)(1) requires every agency to report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach, or identified use of malware on an agency computer or network that the director determines is of a type to create a life-safety event, substantially impact the security of data and information systems, or affect critical systems, equipment, or service delivery.
The agency reporting duty is satisfied if the incident is one the agency must or elects to report to the United States government and, within two hours of that report, the agency gives the director substantially the same information. The term agency includes every county, municipal corporation, school district, or other political subdivision of the state.
The term agency does not include a county, municipal corporation, or public corporation, or an authority of one of them, when it is acting as a provider of wholesale or retail electric or gas service. The director of emergency management and homeland security must, subject to approval by the Governor, promulgate rules and regulations specifying the reporting mechanism, the required information and the time frame for a report under paragraph (1).
Reports or records produced under section 38-3-22.2 are not subject to public inspection or disclosure under Article 4 of Chapter 18 of Title 50. Nothing in section 38-3-22.2 relieves an agency or utility of any duty that may exist under law to notify any person impacted by a cyber attack incident, data breach, or identified use of malware. The Act that added section 38-3-22.2 became effective upon its approval by the Governor or upon its becoming law without such approval. Governor Brian Kemp signed House Bill 156 into law on .
Section 38-3-22.2(c) requires every utility to report to the director of emergency management and homeland security, or the director's designee, any cyber attack incident, data breach, or identified use of malware on a utility computer or network as such information is required to be reported to the United States government or any agency of it.
Within two hours of making that report to the United States government or any agency of it, the utility must provide substantially the same information to the director or the director's designee. If federal law, rule, or regulation prohibits the information from being disseminated, the utility must provide it upon the expiration or lifting of the prohibition.
A utility is any publicly, privately, or cooperatively owned line, facility, or system for producing, transmitting, or distributing power, electricity, light, heat, or gas. Reports or records produced under section 38-3-22.2 are not subject to public inspection or disclosure under Article 4 of Chapter 18 of Title 50.
Nothing in section 38-3-22.2 relieves an agency or utility of any duty that may exist under law to notify any person impacted by a cyber attack incident, data breach, or identified use of malware. The Act that added section 38-3-22.2 became effective upon its approval by the Governor or upon its becoming law without such approval. Governor Brian Kemp signed House Bill 156 into law on .
Age gating law2 instruments, 1 in force, 1 blocked by a court
Research summary (136 words)
Georgia's SB 351 (2024) was enacted as a single act that both restricts minors' social media accounts, requiring parental consent under age 16, and requires age verification on websites publishing material harmful to minors, with both provisions effective . The social media provisions were preliminarily enjoined in NetChoice v. Carr in June 2025.
On the Eleventh Circuit vacated that injunction and remanded the case, and the vacatur takes effect when its mandate issues. The separate harmful to minors age verification provision is not part of that suit (the district court's opinion states the case challenges only Section 3-1 of the act, O.C.G.A. Secs. 39-6-1 to 39-6-5) and is currently in effect. Georgia has not enacted an app store age verification or design code law, though state senators have called for one.
Requires a commercial entity that knowingly publishes a substantial portion of material harmful to minors on a public website, as the applicability criteria define it, to perform reasonable age verification before granting access, using a digitized identification card, government issued identification, or a method meeting the National Institute of Standards and Technology (NIST) Identity Assurance Level 2 standard, with a bar on retaining identifying information after access is granted. Not challenged in NetChoice v. Carr, which covers only the act's social media provisions.
Blocked by a court.blocked by a court A court paused enforcement on . An injunction can be lifted, so the duty may return.
Binds private bodies.
What this law does
Requires social media platforms to use commercially reasonable age verification and to obtain parental consent before a minor under 16 may hold an account, and limits data collection and advertising directed at minors. A federal court preliminarily enjoined these provisions on . On the Eleventh Circuit vacated that injunction and remanded the case to the district court. The court held that NetChoice had not carried its burden on its facial First Amendment challenge. The vacatur takes effect when the Eleventh Circuit's mandate issues.
Our analysis of this law draws on 1 court ruling.Premium data
Where nothing was found1 area of law
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
Georgia has enacted no press-publisher neighbouring right, no mandatory platform-to-publisher bargaining code, and no hot-news or misappropriation statute distinct from general common law. No Georgia bill establishing a journalism usage fee, a link tax, or a machine-readable text-and-data-mining opt-out was identified.
Federal copyright law, including 17 U.S.C. Section 107 fair use and the case law already covered in the national document, governs snippet reproduction, linking, and framing of news content reproduced from or about Georgia and is not restated here.
As of .
Reporting clocks that run here19 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of Georgia comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
If the incident is one you must report, or choose to report, to the United States government or any of its agencies, you satisfy the reporting duty by giving the director substantially the same information within two hours of making that federal report (O.C.G.A. 38-3-22.2(b)(2)).
Within two hours of making that federal report, provide substantially the same information to the director or the director's designee (O.C.G.A. 38-3-22.2(c)).
Give notice of a breach of the security of a system containing a Georgia resident's personal information in the most expedient time possible and without unreasonable delay.
Notify the information broker or data collector you maintain data for of any breach you discover within 24 hours following discovery, so that party can meet its own notice duty.
Notify, without unreasonable delay, all nationwide consumer reporting agencies of the timing, distribution and content of the notices if a breach requires notifying more than 10,000 Georgia residents at one time.
The law of the United States, which applies in Georgia
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
