Data Breach Notice to Residents and State Authorities in North Carolina

At a glance

Requirements one by one

Breach and covered information

Under § 75-61(14), a breach requires unauthorized access and acquisition of unencrypted, unredacted personal information plus actual or likely illegal use or material risk of harm. Acquiring encrypted information with its key also qualifies. Section 75-61(10) pairs a name with the identifying-data list in § 14-113.20(b), which includes government identifiers, financial accounts, biometrics, and passwords. Section 75-65(a) excludes certain online identifiers and passwords from this notice duty unless they allow access to a financial account or resources. Paper records can count.

Resident, owner, and regulator notices

The owner or licensee tells affected people without unreasonable delay after discovering or being notified of the breach. Under § 75-65(a), work may continue to find contacts, measure scope, and restore system integrity, but it sets no numbered outside period. A nonowner holder tells the owner or licensee immediately following discovery under § 75-65(b).

Every affected-person notice also triggers notice to the Attorney General's Consumer Protection Division under § 75-65(e1), without unreasonable delay. The submission gives the breach's nature, affected count, investigation and prevention steps, and the resident notice's timing, distribution, and content. The Division's current reporting page provides an online breach form.

Nationwide reporting agencies

If more than 1,000 people are notified at once, § 75-65(f) also requires notice without unreasonable delay to every nationwide consumer-reporting agency. It reports the resident notice's timing, distribution, and content. The Attorney General duty already applies below this threshold.

Resident delivery and content

Under § 75-65(d), notice must be clear and conspicuous and state the incident, information type, protective steps, a contact number if one exists, vigilance advice, and contact details for major credit agencies, the FTC, and the Attorney General. Section 75-65(e) permits writing, agreed and compliant electronic notice, or a telephone call that reaches the affected person. Substitute notice requires a cost above $250,000, more than 500,000 people, insufficient contacts or consent, or unidentified affected people. It uses available email, a website posting if maintained, and major statewide media; the insufficient-contact and unidentified-person routes apply only to those people.

What trips people up

The law-enforcement delay must be recorded. Under § 75-65(c), the agency's request must be written or contemporaneously documented with the officer and agency named. Notice follows without unreasonable delay once the agency clears it.

The narrow financial-institution route is compliance-based. Under § 75-65(h), a financial institution or credit union complying with the specified federal breach guidance is deemed compliant with this section. Its status alone does not establish the route.

Common questions

Does the AG report wait until 1,000 people are notified? No. Section 75-65(e1) triggers it whenever a business notifies an affected person. The 1,000-person threshold in subsection (f) adds the nationwide agencies.

Can a business send only a voicemail? The telephone route in § 75-65(e)(3) requires direct contact with the affected person.

Statutes and sources

• N.C. Gen. Stat. §§ 75-61, 75-65, 14-113.20(b) — definitions, breach trigger, recipient duties, methods, content, delays, and agency notice. https://www.ncleg.gov/EnactedLegislation/Statutes/PDF/BySection/Chapter_75/GS_75-65.pdf (accessed 2026-10-14)