North Carolina Data Breach Notification Law: A Plain-English Guide

If you hold personal information for someone else, for example as a payroll service, an IT provider or a software vendor, the duty is different: you must notify the owner of the information "immediately following discovery of the breach," and the owner then notifies the people affected (N.C. Gen. Stat. 75-65).

Banks and credit unions that follow specific federal breach guidance are treated as complying with this section (N.C. Gen. Stat. 75-65). For everyone else, the rest of this guide applies.

The exclusions in the right-hand column come from two places: the definition of personal information (N.C. Gen. Stat. 75-61) and a list of items that do not count for the breach notice rule unless they would permit access to a person's financial account or resources (N.C. Gen. Stat. 75-65).

• Paper counts. A stolen box of employee files can be a breach, just like a hacked server.
• A good-faith look by an employee or agent for a legitimate business purpose is not a breach, as long as the information is not misused or disclosed further.
• Ransomware can be a breach. Many gangs copy data before they lock it, so the question is whether personal information was acquired, not just whether files were locked. See our ransomware guide.
• Encryption helps here. Data that was encrypted, with the key kept safe, generally falls outside the definition.

Key takeaway: Whether an incident is a legal "breach" is a judgment call that turns on the facts. Make it with your attorney, and write down how you decided.

The report to the Attorney General must cover the nature of the breach, the number of people affected, the steps taken to investigate it and prevent another one, and the timing, distribution and content of your notice (N.C. Gen. Stat. 75-65). The Department of Justice says it reviews every notice and may investigate whether the organization had reasonable safeguards in place and responded appropriately (NC DOJ).

Those reports add up. The Department counted a record 2,349 breaches in 2025 affecting 9,275,938 North Carolinians, with hacking behind 77 percent of the breaches and phishing behind 16 percent (NC DOJ 2025 Data Breach Report). The Department notes that many people were affected by more than one breach, so that total is not a count of different people. For more of the North Carolina numbers, see our North Carolina Small Business Cyber Risk Report 2026.

Law enforcement can ask you to wait. Notice must be delayed if a law enforcement agency tells you it could impede a criminal investigation or national or homeland security, as long as the request is in writing or you write it down at the time, with the officer's name and agency. Once the agency says notice will no longer interfere, you must send it without unreasonable delay (N.C. Gen. Stat. 75-65).

Key takeaway: "Without unreasonable delay" is not permission to wait. Start the clock the day you discover the breach and keep a dated record of every step.

Substitute notice is allowed only in limited cases: when individual notice would cost more than $250,000, when more than 500,000 people are affected, or for people you have no contact information or consent for. It means email where you have addresses, a conspicuous notice on your website, and notice to major statewide media (N.C. Gen. Stat. 75-65).

To have these steps written down before you need them, start from the free data breach notification procedure template, which follows North Carolina rules by default and is built to be worked through with your attorney.

• A general description of what happened.
• The type of personal information involved.
• What your business has done to protect the information from further unauthorized access.
• A phone number people can call for more information and help, if you have one.
• Advice to stay alert by reviewing account statements and monitoring free credit reports.
• The toll-free numbers and addresses of the major consumer reporting agencies.
• The toll-free numbers, addresses and websites of the Federal Trade Commission and the NC Attorney General's Office, with a statement that people can get information from them about preventing identity theft.

You may hire a records destruction company, but only after due diligence, such as reviewing an independent audit, checking references or reviewing its security policies, and under a written contract you monitor (N.C. Gen. Stat. 75-64). Financial institutions, health insurers and health care facilities, and consumer reporting agencies that comply with their own federal rules are exempt.

Free templates make this quick: a data retention and destruction policy for paper and files, and an IT asset disposal policy for old computers, drives and phones.

Under HIPAA, a breach affecting 500 or more people is reported to HHS at the same time as the individual notices, and smaller breaches are logged and reported within 60 days after the end of the calendar year. Business associates must tell the covered entity within 60 days of discovery (45 CFR Part 164, Subpart D).

The FTC notice under the Safeguards Rule took effect May 13, 2024, and is filed on a form on the FTC's website (16 CFR 314.4 and 16 CFR 314.5). The rule's definition of a financial institution lists examples such as tax preparation services, mortgage brokers and auto dealers that lease vehicles for more than 90 days (16 CFR 314.2). If you are covered, a written information security program is the core document the rule expects.

Contracts and insurance policies can add duties too, such as telling a customer within a set number of hours or calling your insurer before you hire a response firm. Our cyber insurance guide covers the insurance side.

The NC Department of Justice says that when necessary it takes legal action to hold companies responsible and make them strengthen their practices (NC DOJ). Ask your attorney what that exposure means for your business.