North Dakota Data Breach Notification Law

The North Dakota data breach notification law: no harm exception, long data list

Two choices make this statute broad. It skips the risk of harm test entirely, so an actual or reasonably suspected acquisition of unencrypted personal information by an unauthorized person is enough ¹; concluding that nobody will misuse the data changes nothing. And it protects far more than the usual three identifiers.

On top of name with Social Security, license or account-and-code numbers, the list includes ¹:

• Date of birth and mother's maiden name
• Medical information and health insurance information
• Employer ID and student ID numbers
• Digital signatures

So a spreadsheet of employee names and birthdays, or a clinic's intake forms, can be enough by itself.

Timing and the Attorney General notice

The resident clock is a standard: the most expedient time possible and without unreasonable delay, starting at discovery or outside notice ¹.

Past 250 individuals, the Attorney General gets a disclosure by mail or email ¹. No separate AG deadline is given, and the expedient-time wording sits right after the AG sentence, so the simplest reading is to send it with the residents' letters. Bureaus are not involved ¹.

A company that holds records for a client, a cloud host for example, must alert that client immediately after it discovers a breach ¹.

Encryption, deemed compliance and enforcement

Encrypted data, or data made unreadable or unusable another way, is exempt ¹. The statute is silent on a stolen key, so treat the exemption as shaky if the key left with the files. With no harm analysis available, encryption is what keeps a lost laptop or a missing backup drive from becoming a mailing. Get written confirmation that each laptop, phone and backup is encrypted, and file it.

HIPAA entities, financial institutions following the federal interagency guidance, and firms with their own notice policy on the same timing are deemed compliant ¹. A clinic should still understand the federal patient notice rule.

Enforcement borrows the Attorney General's consumer fraud powers, including a civil penalty of up to $5,000 per violation ¹². The statute is silent on private suits over a notice failure.

The first week after a North Dakota breach

With the intrusion still in progress, a policyholder's first call goes to the carrier's claim line, the second report to the FBI via ic3.gov, and no system is wiped before the evidence is copied ³⁴⁵.

Then:

1. Let a breach response firm or your own IT support contain it and trace which records were reached. Look at HR and patient files early; birth dates and insurance details count in this state.
2. Before hiring a lawyer or forensic firm, check whether the policy names its own; typical cyber policy terms covers this.
3. Count the people. Above 250, the AG gets a disclosure. South Dakota and Minnesota residents bring their own states' rules, compared in the breach law chart for every state.
4. Write the resident letters and the AG disclosure together, since one timing standard covers both.
5. Fix the root cause and record it in your security plan.

Century Code check: October 13, 2026. This page explains the law without giving legal advice; a North Dakota lawyer should confirm what you owe.