A note on the text used
Later amendments to chapter 48, if there are any, were not checked. Treat this page as a reading of the 2009 compiled chapter and confirm the current text before relying on it for a live incident.
Data breach notification
Guam data breach notification law
Guam's Notification of Breaches of Personal Information is 9 G.C.A. chapter 48, sections 48.10 to 48.80.
The chapter was added by P.L. 30-004 on March 13, 2009, and this page was checked against the Guam Compiler of Laws copy of chapter 48, dated May 28, 2009.
Personal information on Guam
Personal information means the first name, or first initial, and last name in combination with and linked to one or more data elements that relate to a resident of Guam, when the data elements are neither encrypted nor redacted.
The elements are a Social Security number; a driver's license number or Guam identification card number; and a financial account or card number with any required code or password. The list stops at those three; it does not name medical, biometric or online account data.
When residents must be told
The duty applies where unencrypted and unredacted personal information was, or is reasonably believed to have been, accessed and acquired by an unauthorized person. It is tied to harm: notice is owed where the breach causes, or is reasonably believed to cause, identity theft or other fraud.
On timing, the chapter says the disclosure "shall be made without unreasonable delay." No number of days is given.
No regulator notice
Chapter 48, read in full, does not require notice to the Attorney General or any other regulator. The Attorney General appears only as the enforcer: a violation that results in injury or loss to residents of Guam may be enforced by the Office of the Attorney General.
Where ShareAndGo fits
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Per-viewer watermarks are on by default and are configured room by room. Recipients confirm their email with a six-digit code and need no account. Groups see only the folders they were given, and the chained log, exportable as CSV, lists every view, upload, download, invitation and change with a date. For a small team that has to reconstruct who saw a file, that list does most of the work.
Guam FAQ
Does Guam set a deadline in days?
No. Disclosure shall be made without unreasonable delay.
Is any regulator notified?
Chapter 48 has no Attorney General or regulator notice. The Attorney General is named as enforcer.
Does encrypted data count?
The definition applies when the data elements are neither encrypted nor redacted.
Checked
Checked against the Guam Compiler of Laws copy of chapter 48, dated May 28, 2009 on November 2, 2026. This is general information, not legal advice.