Law / United States / 
North Dakota
Notice of Security Breach for Personal Information
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach of the security system to any affected North Dakota resident in the most expedient time possible and without unreasonable delay.
- Disclose the breach to the North Dakota Attorney General by mail or electronic mail if it exceeds 250 individuals.
- Do not rely on this statute alone to cover a breach of biometric data with no accompanying enumerated element. North Dakota's personal information definition carries no biometric category.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the threshold for notice to the Attorney General in N.D. Cent. Code section 51-30-02, a breach that 'exceeds two hundred fifty individuals', count only North Dakota residents or every individual whose personal information was acquired?
What it makes you log
Logging duty
The chapter requires a person that owns or licenses computerized personal information to disclose a breach to each resident whose unencrypted information was acquired and, above 250 individuals, to the attorney general by mail or email (51-30-02), a person that maintains data it does not own to notify the owner (51-30-03), and allows a delay for law enforcement (51-30-04). It requires no log or record to be kept and names no audit or access to a record. Section 51-30-06 treats a person's own notification procedures kept as part of an information security policy as compliance, which is a policy and not a record of processing. The attorney general enforces the chapter with the powers of chapter 51-15 (51-30-07); that chapter is not cited by the row and its investigative powers are not read for it. The notice duty is owed to residents and the section has no business-in-the-state prong, so the one hook is residence.
- Kind
- None
- As of
What this law does
Any person that owns or licenses computerized data including personal information must disclose a breach of the security system to any affected North Dakota resident, and separately to the Attorney General for a breach exceeding 250 individuals, in the most expedient time possible and without unreasonable delay; the chapter sets no numeric consumer-notification deadline and does not itself define or limit person to a private actor.
Personal information is a name combined with a Social Security number, a driver's or nondriver identification card number, a financial account number, a date of birth, a mother's maiden name, medical or health insurance information, an employer-assigned identification number, or a digitized signature, and excludes publicly available government-records information; biometric data is not among the ten enumerated categories, and this chapter does not reach it at all.
Enforcement runs to the Attorney General, who may use all the powers and remedies of chapter 51-15, North Dakota's unlawful-practices chapter, because a violation of this chapter is deemed a violation of chapter 51-15.
Whether that deeming clause makes chapter 51-15's own private-claim provision, Sec. 51-15-09, available to an individual for a bare notification failure is unresolved: that provision arms a claim specifically against a person who acquired any moneys or property by means of the unlawful practice, language that fits a fraud that took money more naturally than a business's mere failure to notify of someone else's breach, and no North Dakota case law construing this combination was found; secondary characterizations of chapter 51-30 disagree with each other on this point, and that disagreement is not resolved here.
The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .