Law / United States / 
North Carolina
Identity Theft Protection Act, security breach notification
N.C. Gen. Stat. Secs. 75-61, 75-65
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding private bodies.
As of 2 September 2026.
What it requires
- Notify each affected North Carolina resident of a security breach involving their personal information without unreasonable delay, consistent with the legitimate needs of law enforcement.
- Notify the Consumer Protection Division of the North Carolina Attorney General's Office of every breach requiring notice to any affected person, not only breaches above the 1,000-person threshold.
- Do not assume an identifier extracted from a public recording is exempt as biometric data. North Carolina law never defines the term, so neither an exclusion nor a carve-out for such data can be relied upon.
- Expect a breach-notice violation to expose you to a private civil action for treble damages once an injured North Carolina resident can show injury from the violation.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Available only in a suit instituted by the Attorney General under G.S. Sec. 75-15.2, and only where the acts or practices constituting the G.S. Sec. 75-1.1 violation, including a breach-notice violation under G.S. Sec. 75-65(i), were knowingly violative of a statute when committed. The court has discretion to impose up to this amount per violation, weighing the harm caused, the persistence and duration of the conduct, and the violator's assets, liabilities, and net worth. Proceeds are remitted to the Civil Penalty and Forfeiture Fund.
- Rule
- Per violation only
- As of
- 2 September 2026
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
North Carolina Attorney General, Consumer Protection Division: recipient of breach notice under G.S. Sec. 75-65(e1) and (f), and holder of civil penalty authority under G.S. Sec. 75-15.2 for a knowing violation of G.S. Sec. 75-1.1, which a breach-notice violation constitutes
What it reaches
Obligation class
Breach notice
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Any business that owns or licenses personal information of a North Carolina resident, or that conducts business in North Carolina and owns or licenses such information in any form, must give notice of a security breach to the affected person without unreasonable delay, consistent with the legitimate needs of law enforcement; the statute sets no numeric notification deadline.
Business is defined narrowly as a sole proprietorship, partnership, corporation, association, or other group, whether or not organized for profit, with no government entity included.
Personal information is a name combined with identifying information as cross-referenced from North Carolina's criminal identity-theft statute, G.S. Sec. 14-113.20(b), which lists biometric data as one of fourteen enumerated items alongside a Social Security number, a driver's license number, and financial account numbers, but no North Carolina statute anywhere defines what biometric data means for this purpose; the term is used but never defined.
Personal information excludes information a person voluntarily consented to have publicly disseminated and information made lawfully available to the general public from government records, but because biometric data is an undefined cross-referenced term, whether this carve-out would reach an identifier derived from a public recording cannot be evaluated.
A business must also notify the Consumer Protection Division of the Attorney General's Office on every breach requiring notice to any affected person, and separately, on any breach affecting more than 1,000 persons at one time, must notify nationwide consumer reporting agencies.
A violation of the notice duty is a violation of North Carolina's general Unfair and Deceptive Trade Practices Act, G.S. Sec. 75-1.1, but an individual may not sue for that violation unless injured by it; once that injury threshold is met, G.S. Sec. 75-16 arms the injured person with a civil action for treble damages. Most recently amended by Session Law 2025-25.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachprocesses_biometrics
Read the law
official North Carolina statute text, General Statutes Chapter 75, Article 2A
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.