Law / United States / 
North Carolina
Identity Theft Protection Act, security breach notification
N.C. Gen. Stat. Secs. 75-61, 75-65
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Obligation class
- Breach notice
- Audit expectation
- none
What it requires
- Notify each affected North Carolina resident of a security breach involving their personal information without unreasonable delay, consistent with the legitimate needs of law enforcement.
- Notify the Consumer Protection Division of the North Carolina Attorney General's Office of every breach requiring notice to any affected person, not only breaches above the 1,000-person threshold.
- If you are an agency of the State or its political subdivisions, or an agent or employee of a government agency, that experiences a security breach as defined in the Identity Theft Protection Act, comply with the breach-notice requirements of G.S. 75-65 (G.S. 132-1.10(c1)).
- Do not assume an identifier extracted from a public recording is exempt as biometric data. North Carolina law never defines the term, so neither an exclusion nor a carve-out for such data can be relied upon.
- Expect a breach-notice violation to expose you to a private civil action for treble damages once an injured North Carolina resident can show injury from the violation.
These lines are LexLint's reading of the law's text. Also read by: North Carolina Department of Justice (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
- NIST CSF 2.0
- RS.CO-02Internal and external stakeholders are notified of incidents
- FINOS AIGF
- AIR-DET-001AI Data Leakage Prevention and Detection
- AIR-DET-004AI System Observability
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Available only in a suit instituted by the Attorney General under G.S. Sec. 75-15.2, and only where the acts or practices constituting the G.S. Sec. 75-1.1 violation, including a breach-notice violation under G.S. Sec. 75-65(i), were knowingly violative of a statute when committed. The court has discretion to impose up to this amount per violation, weighing the harm caused, the persistence and duration of the conduct, and the violator's assets, liabilities, and net worth. Proceeds are remitted to the Civil Penalty and Forfeiture Fund.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
North Carolina Attorney General, Consumer Protection Division: recipient of breach notice under G.S. Sec. 75-65(e1) and (f), and holder of civil penalty authority under G.S. Sec. 75-15.2 for a knowing violation of G.S. Sec. 75-1.1, which a breach-notice violation constitutes
Settledness
- As of
- Guidance link
- https://ncdoj.gov/protecting-consumers/protecting-your-identity/protect-your-business-from-id-theft/security-breach-information/
- Guidance body
- North Carolina Department of Justice
- Open questions
- Must a business that notifies 1,000 or fewer persons also notify the nationwide consumer reporting agencies, as the Attorney General's guidance states without a threshold, or only when it notifies 'more than 1,000 persons at one time' under G.S. 75-65(f)?
- Are persons notified in successive waves about one breach added together to pass the 'more than 1,000 persons at one time' threshold in G.S. 75-65(f)?
What it makes you log
Logging duty
Section 75-65(c) requires a business to delay breach notice when law enforcement says notice may impede an investigation or jeopardize national or homeland security, on a request made in writing or one the business documents contemporaneously in writing with the name of the officer and the agency, so a business that delays holds a written record of the request. The rest of the section is notice: to the affected person with a stated content (subsection (d)), to the Attorney General's Consumer Protection Division of the nature of the breach, the number affected, the steps taken to investigate and prevent a repeat, and the timing, distribution and content of the notice (subsection (e1)), and, above 1,000 persons, to the consumer reporting agencies (subsection (f)). Those are notices and not records kept. The section sets no log contents from the vocabulary, no retention period, no audit and no regulator access to a record. It binds a business that owns or licenses personal information of North Carolina residents, or that conducts business in the state.
- Kind
- Implicit
- As of
- Provision
- 75-65(c) (a delay of breach notice rests on a law enforcement request made in writing or documented contemporaneously in writing)
- Trigger
- security_incident
What this law does
Any business that owns or licenses personal information of a North Carolina resident, or that conducts business in North Carolina and owns or licenses such information in any form, must give notice of a security breach to the affected person without unreasonable delay, consistent with the legitimate needs of law enforcement; the statute sets no numeric notification deadline.
Business is defined narrowly as a sole proprietorship, partnership, corporation, association, or other group, whether or not organized for profit, and the definition excludes any government or governmental subdivision or agency.
A separate provision, section 132-1.10(c1) of the General Statutes, requires an agency of the State or its political subdivisions, or any agent or employee of a government agency, that experiences a security breach to comply with the requirements of section 75-65, the breach-notice section.
Personal information is a name combined with identifying information as cross-referenced from North Carolina's criminal identity-theft statute, G.S. Sec. 14-113.20(b), which lists biometric data as one of fourteen enumerated items alongside a Social Security number, a driver's license number, and financial account numbers, but no North Carolina statute anywhere defines what biometric data means for this purpose; the term is used but never defined.
Personal information excludes information a person voluntarily consented to have publicly disseminated and information made lawfully available to the general public from government records, but because biometric data is an undefined cross-referenced term, whether this carve-out would reach an identifier derived from a public recording cannot be evaluated.
A business must also notify the Consumer Protection Division of the Attorney General's Office on every breach requiring notice to any affected person, and separately, on any breach affecting more than 1,000 persons at one time, must notify nationwide consumer reporting agencies.
A violation of the notice duty is a violation of North Carolina's general Unfair and Deceptive Trade Practices Act, G.S. Sec. 75-1.1, but an individual may not sue for that violation unless injured by it; once that injury threshold is met, G.S. Sec. 75-16 arms the injured person with a civil action for treble damages. Most recently amended by Session Law 2025-25. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .