North Carolina. Breach notification. Act
NC breach lawNorth Carolina data breach notification law (N.C. Gen. Stat. §§ 75-61, 75-65 (Identity Theft Protection Act))
Partly verified
Medium confidence.Pending 2025-26 bills to expand NC law not checked.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about North Carolina residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay. Covered data: name plus SSN/employer TIN, driver's licence/passport, account/card numbers, PINs, digital signatures, biometric data; email/online IDs only if they permit financial access.
- Key themes
- Unique features
Breach defined to include material risk of harm; violations treated as unfair trade practices with private action (treble damages under UDTPA).
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: North Carolina requires the possessing business to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay; AG Consumer Protection Division for every notifiable breach; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- UDTPA: treble damages for private plaintiffs; AG civil penalties up to $5,000 per violation
§3Dates
- Key dates
- Adopted
- In force
- SB 1017 (2009) latest amendment identified
§4Text and authority
- Text
- Authoritative text ncleg.gov
- Authority
- North Carolina Department of Justice (Attorney General)
§5Where it applies
- Domestic law of
- North Carolina
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Pending 2025-26 bills to expand NC law not checked.