North Carolina Data Breach Notification Law

What the North Carolina data breach notification law asks of a business

The clock in G.S. 75-65 starts at discovery or at an outside tip, and the measure is without unreasonable delay ¹. Reasonable time includes a police hold, tracking down contact details, sizing up the breach and getting systems running again. A police request to wait has to be put in writing.

Two features catch owners off guard. Paper counts as much as computer files, so a box of client folders stolen from a car qualifies ¹. And the Attorney General hears about every notice, whatever the count.

A 2025 law, S.L. 2025-25 (House Bill 40), made wording-only edits to the section, such as "email" and "website" ². The notice rules did not change.

What goes to the Attorney General

The Attorney General's Consumer Protection Division gets a report, without unreasonable delay, each time the business sends notice to anyone ¹. It describes:

• The nature of the breach
• The number of consumers affected
• The steps taken
• The timing, distribution and content of the notice

Past 1,000 people notified, the consumer reporting agencies receive word too ¹. A service provider holding records for a client must alert that client immediately.

The long list of identifiers North Carolina protects

The statute reaches well past name plus SSN, license or card number ¹³:

• Passport numbers and taxpayer ID numbers
• An account number on its own, PIN codes and digital signatures
• Biometric data
• Other numbers or information that can be used to access a person's financial resources

Email addresses, internet account names, passwords and a parent's surname before marriage count only when they would permit access to a financial account or resources ¹. So a stolen online banking password is covered, while a password to a newsletter account usually is not.

Encrypted and redacted data sit outside the law, except that getting into and taking encrypted files together with the confidential process or key is a breach ⁴.

When an incident is not a breach

North Carolina treats an incident as a breach only if illegal use of the data has happened or is reasonably likely, or it creates a material risk of harm to a consumer ⁴. The law does not ask for a memo when you decide against notice; file one with the forensic report regardless.

Financial institutions that follow the 2005 federal interagency breach guidance are treated as compliant ¹.

Who can sue in North Carolina

A person hurt by a violation of G.S. 75-65 can sue, while someone with no injury cannot ¹. The Attorney General can also pursue a violation as an unfair or deceptive trade practice under G.S. 75-1.1 ¹. Basic controls for a small company are the cheapest way to stay out of either case.

After a North Carolina breach: who to call, what to send

With attackers still on the network, a business holding a cyber policy calls the carrier before anyone else, reports to the FBI's complaint center at ic3.gov, and images disks and saves logs before anything is wiped ⁵⁶⁷.

Next, a forensic response firm or your existing IT vendor shuts the attackers out, confirms what was exposed and groups people by home state. Virginia also requires attorney general notice with no minimum count, and South Carolina wants its Department of Consumer Affairs told once more than 1,000 residents are notified; the breach chart for all states covers the others. Panel counsel and other policy conditions are explained in what cyber insurers require. Local support costs are covered in our guides for Charlotte, Raleigh, Durham and Greensboro.

G.S. 75-65 and this reading were lined up on October 13, 2026. Because injured residents can sue here, rely on legal advice from a North Carolina lawyer rather than on a summary.