North Dakota. Breach notification. Act
ND breach lawNorth Dakota data breach notification law (N.D. Cent. Code § 51-30-01 et seq.)
Partly verified
Medium confidence.Penalty from general consumer fraud provision.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about North Dakota residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's/non-driver ID, financial account with codes, date of birth, mother's maiden name, medical and health insurance data, employer ID with code, electronic signature.
- Key themes
- Unique features
Unusually broad PI (date of birth, mother's maiden name, electronic signatures); low 250 AG threshold; no risk-of-harm exception.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: North Dakota requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; AG if >250 individuals
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $5,000 per violation under Consumer Fraud Act
§3Dates
- Key dates
- Adopted
- In force
- SB 2214 (2015, eff. 2015-08-01) added AG notice
§4Text and authority
- Text
- Authoritative text ndlegis.gov
- Authority
- North Dakota Attorney General (Consumer Protection Division)
§5Where it applies
- Domestic law of
- North Dakota
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty from general consumer fraud provision.