Law / United States / Guam
Notification of Breaches of Personal Information
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force.
A breach notification rule binding public and private bodies.
As of 5 September 2026.
What it requires
- Disclose a breach of the security of your system to any affected Guam resident without unreasonable delay once you know or reasonably believe the breach caused or will cause identity theft or other fraud.
- If you hold a Guam resident's computerized personal information for another owner or licensee rather than for yourself, notify that owner or licensee as soon as practicable after discovering a breach.
- Do not treat this chapter as reaching biometric data: its personal-information definition covers only a Social Security number, a driver's license or Guam ID number, or a financial account or card number, none of them biometric.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty only, not to exceed $150,000 per breach of the security of the system or per series of breaches of a similar nature discovered in a single investigation; the Attorney General may instead elect actual damages.
- Rule
- Fixed only
- As of
- 5 September 2026
- Currency
- USD
- Fixed cap
- 150,000
Who enforces it
Enforcement body
Attorney General of Guam (exclusive)
What it reaches
Obligation class
Breach notice
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
An individual or entity that owns or licenses computerized data including personal information must disclose a breach of the security of the system to any affected Guam resident without unreasonable delay once it discovers or is notified of the breach and reasonably believes it has caused or will cause identity theft or other fraud; an entity holding such data for another owner or licensee must instead notify that owner or licensee as soon as practicable.
Personal information is a first name or initial and last name combined with a Social Security number, a driver's license or Guam identification card number, or a financial account, credit, or debit card number together with any required access code, and it excludes information lawfully obtained from publicly available sources or government records; the definition carries no biometric-data category.
Guam added this chapter on March 13, 2009 and its own text sets the chapter's effective date at one hundred twenty days after that enactment date, without stating the resulting calendar day; the Office of the Attorney General has exclusive authority to enforce it.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach