Data Breach Notice to Residents and State Authorities in North Dakota

At a glance

Requirements one by one

The trigger and the parties

North Dakota's § 51-30-01 requires unauthorized acquisition of computerized personal information whose access was not secured by encryption or another method rendering the data unreadable or unusable. The list of covered combinations includes a name with a birth date, mother's maiden name, medical or insurance details, certain employer IDs, or an electronic signature.

The owner or licensee tells a North Dakota resident whose unencrypted personal information was or likely was acquired (§ 51-30-02). A nonowner data holder tells the owner or licensee immediately after discovery if acquisition occurred or is reasonably believed to have occurred (§ 51-30-03).

Timing and additional recipients

Section 51-30-02 calls for disclosure in the most expedient time possible and without unreasonable delay after discovery or notification, consistent with law-enforcement needs and measures to determine breach scope and restore system integrity. It supplies no fixed outside number of days.

A breach exceeding 250 individuals also triggers mail or email notice to the attorney general (§ 51-30-02). The statutory count says "individuals" rather than limiting the threshold to residents of the state. The chapter does not set a separate nationwide consumer-reporting-agency notice route.

Delivery and delay

Under § 51-30-05, notice may be written or E-SIGN-consistent electronic notice. Substitute notice becomes available if ordinary notice would cost over $250,000, the affected class exceeds 500,000, or contact information is insufficient. It combines available email, website posting if maintained, and major statewide media. The chapter states no additional resident-letter content list.

Under § 51-30-04, a law-enforcement agency determination that notice would impede a criminal investigation permits delay until the agency determines the notice will not compromise it. Under § 51-30-06, timely own-policy notice, qualifying federal financial guidance, and a covered HIPAA breach-notification route may satisfy the chapter.

What trips people up

Birth dates and electronic signatures appear in the covered combinations. Those elements are listed in § 51-30-01(4); checking only financial-account or Social Security data can miss them.

The attorney-general count is not written as an in-state count. Section 51-30-02 uses "exceeds two hundred fifty individuals" after requiring notice to affected state residents. The two phrases should be read separately.

Common questions

Can the nonowner holder wait for a complete investigation before telling the owner?

Section 51-30-03 says immediately following discovery when unauthorized acquisition occurred or is reasonably believed to have occurred.

Does a good-faith employee access always count as a breach?

Section 51-30-01(1) excludes good-faith employee or agent acquisition if the information is neither used nor subject to further unauthorized disclosure.

Can the business choose phone calls for resident notice?

Section 51-30-05 lists writing, qualifying electronic notice, and substitute notice; it does not list telephone notice.

Statutes and sources

• N.D. Cent. Code §§ 51-30-01–06 — official chapter PDF containing the cited definitions, notices, methods, and alternatives.

Current official North Dakota Century Code checked October 14, 2026.