Law / United States / North Dakota

Insurance Data Security Law, investigation and notification of a cybersecurity event

N.D. Cent. Code §§ 26.1-02.2-04, 26.1-02.2-05

In force.

A vulnerability and incident reporting rule binding private bodies.

Obligation class

Reporting, Security

As of 27 October 2026.

What it requires

• Applies to a licensee under North Dakota insurance law, which you declare by stating that you are an insurer, with the notice owed where North Dakota is your state of domicile (an insurer) or your home state (a producer), or where you reasonably believe the nonpublic information involved is of 250 or more consumers residing in North Dakota.
• If you learn that a cybersecurity event has or may have occurred, conduct a prompt investigation, or have an outside vendor or service provider designated to act on your behalf conduct one: determine whether an event occurred, assess its nature and scope, identify the nonpublic information involved, and perform or oversee reasonable measures to restore the security of the compromised information systems; keep records of every cybersecurity event for at least five years and produce them on the commissioner's demand.
• Notify the commissioner as promptly as possible, and no later than three business days from your determination that a cybersecurity event has occurred, where the event triggers notification to a consumer residing in North Dakota under chapter 51-30 or has a reasonable likelihood of harming any material part of your normal operations.
• Notify the commissioner within the same three business days where you reasonably believe the nonpublic information involved is of two hundred fifty or more consumers residing in North Dakota and the event requires notice to any government body, self-regulatory agency, or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in North Dakota or any part of your normal operations.
• Give the notice in electronic form as the commissioner directs, update and supplement it for material changes, and provide as much as possible of what the section lists: the date and cause of the event, how it was discovered, whether information was recovered, the source, whether a police report or other regulatory notice was made, the types of information, the period of compromise, the number of affected North Dakota consumers, the results of your internal review, your remediation efforts, a copy of your privacy policy and a statement of the steps you will take to investigate and notify consumers, and a contact person.
• Comply with chapter 51-30, as applicable, and give the commissioner a copy of the notice sent to consumers when you must notify the commissioner.
• Treat a cybersecurity event in a system maintained by a third-party service provider, of which you have become aware, as your own event unless the provider gives the commissioner the notice, with your deadline running from the day after the provider notifies you or you otherwise have actual knowledge of the event.
• If you are an assuming insurer, notify your affected ceding insurers and the commissioner of your state of domicile within three business days of making the determination that a cybersecurity event has occurred, or within three business days of receiving notice from your third-party service provider.
• If you are an insurer and consumer notice is required by chapter 51-30 for an event involving a consumer who reached you through an independent insurance producer, notify the producers of record of all affected consumers no later than the time you notify the consumers.

These lines are LexLint's reading of the law's text, as of 27 October 2026.

If you get it wrong

Who enforces it

When LexLint raises it

When your app profile says your app is an insurer.

Back to the example  ·  Lint your app