← All US breach laws·NC

North Carolina data breach notification law

North Carolina's data breach notification requirements under N.C. Gen. Stat. §§75-60 to 75-65 (Identity Theft Protection Act). Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
N.C. Gen. Stat. §§75-60 to 75-65
Enforcer
North Carolina Attorney General — Consumer Protection
AG notification
Required
Private right of action
Yes — residents can sue

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
Yes — written notice to the AG Consumer Protection Division (no resident-count threshold)
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required when there is reasonable likelihood that the PI may be misused
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under North Carolina law

First name/initial + last name with SSN, employer/taxpayer ID, DL/state ID, financial account + access code, digital signature, biometric data, fingerprints, or passwords

Penalties and enforcement

Up to $5,000 per violation under Unfair and Deceptive Trade Practices Act; private right of action
Enforced by: North Carolina Attorney General — Consumer Protection. Official regulator page →

Common pitfalls

⚠ North Carolina requires AG notice REGARDLESS of resident count — a single NC resident triggers filing

Frequently asked questions

How long do I have to notify North Carolina residents after a data breach?
Without unreasonable delay
Do I have to notify the North Carolina Attorney General?
Yes — written notice to the AG Consumer Protection Division (no resident-count threshold)
Does North Carolina require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from North Carolina's breach notification requirement?
Yes — North Carolina has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can North Carolina residents sue me directly for a data breach?
Yes — North Carolina allows a private right of action. Affected residents may sue for actual damages and, in some cases, statutory damages or attorneys' fees. Class actions are common.
What counts as 'personal information' under North Carolina law?
First name/initial + last name with SSN, employer/taxpayer ID, DL/state ID, financial account + access code, digital signature, biometric data, fingerprints, or passwords
What are the penalties for failing to comply with North Carolina's breach notification law?
Up to $5,000 per violation under Unfair and Deceptive Trade Practices Act; private right of action

Related state breach laws

New Mexico (NM)
N.M. Stat. §§57-12C-1 to 57-12C-12
New York (NY)
N.Y. Gen. Bus. Law §899-aa + §899-bb
North Dakota (ND)
N.D. Cent. Code §§51-30-01 to 51-30-07
Ohio (OH)
Ohio Rev. Code §§1349.19

Pre-empt the North Carolina breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against North Carolina's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit