Free Data Breach Notification Procedure Template for North Carolina Businesses

This procedure sets out the steps [Company Name] (the "company") follows, together with its breach counsel, to decide whether a security incident requires notice to individuals, regulators, or others, and, when it does, to send accurate notices to the right recipients, by a permitted method, on time. Its goals are to protect the people whose information was exposed, to meet every legal and contractual notice duty, and to keep a record that shows how each decision was made.

Relationship to the incident response plan. This procedure supplements the company's incident response policy and plan, where adopted, and in particular its section on legal, regulatory, and contractual notification. The incident response plan governs containment, investigation, and recovery; this procedure governs the notice decision and the notices themselves. If they conflict, the stricter requirement applies, and legal counsel resolves any question about notification.

Information covered. The procedure applies to personal information as defined by the law of each state where affected people live, and by default to personal information as North Carolina defines it (see Definitions), in any form, whether electronic, paper, or otherwise. The company has identified that it handles personal information about employees, customers, and other individuals.

Default law and other states. The company is headquartered in North Carolina, so this procedure uses North Carolina law (N.C. Gen. Stat. 75-61 and N.C. Gen. Stat. 75-65) as its default. People who live in other states are protected by the laws of those states, which breach counsel applies alongside North Carolina law (see People in Other States and Countries).

Banks and credit unions. N.C. Gen. Stat. 75-65(h) treats a financial institution or credit union that is subject to and in compliance with the federal interagency guidance on response programs it names as complying with that section. If the company may be such an institution, breach counsel confirms whether that applies before any other North Carolina step is relied on.

Not legal advice. This procedure is general information drawn from the statutes and regulations it names. It is not legal advice, it does not decide whether any incident is a reportable breach, and it does not replace the judgment of a licensed attorney who knows the facts.

Counsel decides. No one at [Company Name] tells affected people, regulators, customers, the media, or the public that a breach has or has not occurred, and no notice of any kind is sent, until breach counsel has confirmed which laws apply and determined in writing whether notice is legally required, and the executive decision-maker has approved the notice, its content and its method on that advice. This does not limit the Protected Reports section.

Laws change and differ. Breach notification laws differ by state, by industry, and by type of data, and they are amended. The statutes summarized here were current when this template was last reviewed, and breach counsel confirms the current text at every use. This procedure is a starting point, not a complete list of obligations.

Insurance and contracts. Confirm with breach counsel and the cyber insurer before notifying anyone or hiring outside firms. The cyber insurance policy may require prompt notice of a claim and the insurer's consent before the company hires counsel, forensic investigators, or notification vendors, and costs incurred without consent may not be covered. Customer and vendor contracts may require notice sooner than any law.

Personal information (North Carolina)

Under N.C. Gen. Stat. 75-61(10), a person's first name or first initial and last name in combination with identifying information as defined in G.S. 14-113.20(b). That identifying information includes Social Security or employer taxpayer identification numbers; driver's license, State identification card, or passport numbers; checking and savings account numbers; credit and debit card numbers; PINs; digital signatures; biometric data; fingerprints; and any other numbers or information that can be used to access a person's financial resources. It does not include publicly available directories a person voluntarily consented to be listed in, or information lawfully made available to the general public from government records.

Items that count only if they open a financial account

For notice purposes, N.C. Gen. Stat. 75-65(a) says personal information does not include electronic identification numbers, email names or addresses, internet account numbers, internet identification names, a parent's legal surname prior to marriage, or a password, unless this information would permit access to a person's financial account or resources.

Security breach (North Carolina)

Under N.C. Gen. Stat. 75-61(14), "An incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer." Access to and acquisition of encrypted records along with the confidential process or key is also a security breach. Good-faith acquisition by an employee or agent for a legitimate purpose is not a security breach, provided the information is not used for a purpose other than a lawful purpose of the business and is not subject to further unauthorized disclosure.

Encryption

Under N.C. Gen. Stat. 75-61(8), the use of an algorithmic process to transform data into a form in which the data is rendered unreadable or unusable without use of a confidential process or key.

Redaction

Under N.C. Gen. Stat. 75-61(13), rendering data unreadable, or truncating it so that no more than the last four digits of the identification number is accessible.

Owner or licensee, and maintainer

A business that owns or licenses personal information gives notice to affected people under N.C. Gen. Stat. 75-65(a). A business that maintains or possesses personal information it does not own or license notifies the owner or licensee under N.C. Gen. Stat. 75-65(b).

Discovery

The time an incident is first known, or by exercising reasonable diligence would have been known, to any employee, officer or agent of the company other than the person who caused it. Breach counsel confirms how each law defines discovery.

Breach counsel

The attorney or law firm, experienced in data breach response, who determines whether notice is legally required and advises the company on every notice.

Contact roster. The privacy lead keeps this roster current, checks it at least every quarter, and keeps a printed copy with the incident response plan. Blank entries are filled in by hand. Questions about this procedure go to the Privacy Lead.

• Keep an inventory of where personal information is stored, in systems and on paper, whose information it is, and which states those people live in. Step 4 starts from this inventory.
• Keep laptops, servers, backups, and file transfers that hold personal information encrypted, and store encryption keys and recovery codes separately from the data they protect, because the North Carolina encryption exception ends when the key is taken with the data.
• Know the cyber insurance policy's notice and consent terms, its claim line, and its panel of approved counsel, forensic firms, and notification vendors.
• Keep a list of customer, vendor, and partner contracts that require notice of a security incident, with each deadline.
• Have breach counsel review, in advance, the Notice Content Worksheet in this procedure so drafting starts from an agreed outline, not a blank page.
• Walk through Steps 1 to 9 in the annual incident response tabletop exercise, using a realistic scenario such as a stolen laptop or a ransomware attack that copied files.

As soon as an incident may involve personal or regulated information, the incident response plan's containment steps begin and this procedure starts in parallel. The privacy lead opens a notification file and records the date and time of discovery, who discovered it, and how. The breach assessment with breach counsel begins within 24 hours of the report.

1. Contain the incident without destroying evidence: disconnect affected devices from the network rather than wiping or rebuilding them, disable compromised accounts, and keep logs, emails, and files as they are.
2. Ask IT and any forensic firm to establish, with evidence, which systems, mailboxes, and files were accessed and whether anything was copied, downloaded, or taken. For paper, the privacy lead establishes which files, boxes, or documents were lost, stolen, or seen, and by whom.
3. Identify the data elements in those records, for example names together with Social Security, driver's license, account, or card numbers, and whether each record was encrypted or redacted.
4. If records were encrypted, find out whether the key, password, or recovery code was stored with them or could also have been taken.
5. Record every fact, its source, and the time it was learned in the notification file. Facts change as the investigation goes on, so record what changed and why.
6. Do not contact affected people, customers, or the media, and do not post anything publicly, until notice is approved as this procedure requires. This does not limit the Protected Reports section.

1. The Chief Executive Officer or the privacy lead calls breach counsel as soon as an incident may involve personal or regulated information, before the facts are complete. Breach counsel is a law firm from the cyber insurer's approved panel, engaged through the insurer's claim process so that its fees are more likely to be covered.
2. The insurer liaison reports the incident to the cyber insurer through its claim line as the policy requires, and asks which panel counsel, forensic firm, and notification vendor the insurer approves. Vendors are hired only with the insurer's consent where the policy requires it.
3. Breach counsel decides how the forensic firm is engaged, who receives its reports, and how findings are written down.
4. The privacy lead gives breach counsel the list of contracts that require notice of a security incident. Counsel decides whether any contract deadline has started, because some customer contracts require notice sooner than any law.
5. The executive decision-maker and breach counsel agree on how often they will meet, for example daily, until the notice decision is made.

Breach counsel decides whether the incident meets the definition of a breach under each law that applies. Breach counsel determines whether notice is legally required. The executive decision-maker approves sending each notice, its content and its method on that advice, and never overrides a determination that notice is required. For North Carolina residents, N.C. Gen. Stat. 75-61(14) defines a security breach as: "An incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer."

Questions counsel works through. Each of the following must be answered from the evidence gathered in Step 1. The Notification Decision Checklist in this procedure records the answers.

1. Was there unauthorized access to records or data, and was there also acquisition? The North Carolina definition requires both.
2. Did those records contain personal information as defined in the Definitions section, including any item that counts only because it would permit access to a financial account?
3. Were the records unencrypted and unredacted? Encrypted records are outside the definition, but access to and acquisition of encrypted records "along with the confidential process or key" is a security breach.
4. Has illegal use of the personal information occurred, is it reasonably likely to occur, or does the incident create a material risk of harm to a consumer? The statute uses these words, and breach counsel applies them to the facts.
5. Does the good-faith exception apply: acquisition by an employee or agent for a legitimate purpose, with no use other than a lawful purpose of the business and no further unauthorized disclosure?

Paper and ransomware. N.C. Gen. Stat. 75-65(a) covers personal information "in any form (whether computerized, paper, or otherwise)". In a ransomware attack the question is whether personal information was accessed and acquired, for example copied out before files were locked, not only whether files were locked, so breach counsel reviews every ransomware incident.

Other laws use other tests. Other states, HIPAA, and the FTC Safeguards Rule each define a breach or reportable event in their own words, and some presume a breach unless a documented assessment shows otherwise. Breach counsel applies each applicable definition separately; a "no" under North Carolina law does not settle the question for any other law.

Record the decision either way. Whether the answer is "notify" or "do not notify", breach counsel and the executive decision-maker record the decision, the facts it rests on, the date, and who made it. A decision not to notify is reopened if new facts emerge.

The privacy lead, working with IT, HR, and the forensic firm, builds a confidential list of affected people. The list is stored with restricted access and shared only with breach counsel and approved vendors.

Counts that change what is required. Under N.C. Gen. Stat. 75-65(f), notice to more than 1,000 persons at one time adds notice to the nationwide consumer reporting agencies, and under N.C. Gen. Stat. 75-65(e)(4) an affected class of more than 500,000 is one of the conditions for substitute notice. The privacy lead keeps the counts current and tells breach counsel whenever a count crosses one of these numbers.

Where people live. The company holds information about people in its home state and a few nearby states. The list of states goes to breach counsel for the multistate analysis.

Reporting a crime to the FBI or local police does not by itself delay notice. Under N.C. Gen. Stat. 75-65(c), notice is delayed only if a law enforcement agency informs the company that notification may impede a criminal investigation or jeopardize national or homeland security, and only if the request is made in writing or the company documents it contemporaneously in writing.

1. Ask the officer to put the request in writing. If the request is made orally, the privacy lead writes it down at once, including the name of the law enforcement officer making the request and the officer's law enforcement agency engaged in the investigation, and gives a copy to breach counsel.
2. Keep preparing the notices during the delay, so they are ready to send.
3. Check in with the agency on a schedule breach counsel sets, and record each contact.
4. When the agency communicates that notice will no longer impede the investigation or jeopardize national or homeland security, send notice without unreasonable delay, as N.C. Gen. Stat. 75-65(c) requires.

Breach counsel confirms every row of this table for the specific incident before any notice is sent. The North Carolina rows apply when personal information of North Carolina residents is involved. Conditional federal and contract duties appear in their own sections of this procedure, where they apply.

What the Attorney General receives. Under N.C. Gen. Stat. 75-65(e1), the report to the Consumer Protection Division covers the nature of the breach, the number of consumers affected, steps taken to investigate the breach, steps taken to prevent a similar breach in the future, and information regarding the timing, distribution, and content of the notice. The NC Department of Justice says it reviews every notice and may investigate whether the organization had reasonable safeguards in place and responded appropriately, so the report is drafted with breach counsel.

N.C. Gen. Stat. 75-65(d) requires the notice to be clear and conspicuous and to include all of the following. The wording below follows the statute; it is a checklist for breach counsel, not letter text.

1. A description of the incident in general terms.
2. A description of the type of personal information that was subject to the unauthorized access and acquisition.
3. A description of the general acts of the business to protect the personal information from further unauthorized access.
4. A telephone number for the business that the person may call for further information and assistance, if one exists.
5. Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.
6. The toll-free numbers and addresses for the major consumer reporting agencies.
7. The toll-free numbers, addresses, and website addresses for the Federal Trade Commission and the North Carolina Attorney General's Office, along with a statement that the individual can obtain information from these sources about preventing identity theft.

Drafting rules. Breach counsel drafts or reviews every notice, and the executive decision-maker approves it on that advice before it is sent. Phone numbers, addresses, and websites for the consumer reporting agencies, the FTC, and the Attorney General's Office are confirmed as current on the day the notice is finalized. Other states and federal rules may require different or additional content, and some letters must serve several laws at once, so breach counsel advises on the final content, which the executive decision-maker approves. Whether to offer credit monitoring or identity protection is decided by the executive decision-maker on breach counsel's advice, including whether any law or contract requires it.

N.C. Gen. Stat. 75-65(e) permits notice to affected persons by one of the following methods. Breach counsel chooses the method for each group of people.

What substitute notice consists of. Where substitute notice is permitted, it consists of all of the following: email notice when the company has an email address for the persons; conspicuous posting of the notice on the company website, if one is maintained; and notification to major statewide media. The privacy lead keeps the evidence that a substitute notice condition was met, such as vendor cost quotes or the list of persons without contact information.

Notification vendor. Mailing, address updates, email delivery, and the call center are handled by a notification vendor engaged through breach counsel or the cyber insurer. The vendor receives only the data it needs, under a written agreement, and returns or destroys it when the work ends. The call center works from a script the Communications Lead prepares and breach counsel approves.

Notification file. The privacy lead keeps, in one restricted file: the discovery record, the facts and their sources, the breach determination and its reasons, the list of affected people and counts by state, any law enforcement delay request, copies of every notice and regulator report with dates and methods, proof of mailing and delivery, call center reports, breach counsel's written determinations and advice, and the executive decision-maker's approvals.

Retention. The file is kept for at least 5 years after the incident is closed. A legal hold always overrides this period.

• Returned mail and bounced email: track each one, look for a better address, and ask breach counsel whether substitute notice is needed for those people.
• Call center: review questions weekly, update the approved script, and route anything unusual to breach counsel.
• New facts: if the investigation finds more people or more data types, breach counsel decides whether supplemental notices or regulator updates are needed.
• Contracts and insurance: confirm that every contract notice and every insurer requirement has been met, and record it.
• Post-incident review: within 30 days after the last notice is sent, the privacy lead reviews what worked and what did not with the notification team and the Chief Executive Officer, and updates this procedure, the contact roster, and the data inventory.

The privacy lead completes this checklist during Steps 3 to 6 and files it with the notification file. Each answer is yes, no, or unknown, with a note on the evidence. An unknown answer is a reason to keep investigating, not a reason to assume no.

This worksheet is not a letter. It tracks each element N.C. Gen. Stat. 75-65 requires until breach counsel has drafted or reviewed it and the executive decision-maker has approved it. Counsel drafts or reviews the final wording of every notice.

North Carolina's notice law reaches personal information "of residents of North Carolina", and other states' laws protect their own residents. Their definitions of personal information and breach, deadlines, regulator notices, and required content can differ from North Carolina's. Breach counsel runs a multistate analysis for every incident that affects people outside North Carolina and decides which laws apply.

States to prepare for. The privacy lead lists the states where customers, employees, and other contacts live, and breach counsel is asked, before any incident, to keep a summary of those states' notice rules on file and to update it at each annual review.

Review. The Privacy Lead owns this procedure and reviews it with breach counsel no later than October 13, 2027, and sooner after any incident in which notice was considered, any change to North Carolina or federal breach law, a change of insurer or counsel, new regulated data, or a new contract with notice terms.

Practice and training. The notification team walks through this procedure in the annual incident response tabletop exercise, including a notice decision and a review of the contact roster. Members of the notification team are trained on their roles when they join it.

Enforcement. Notifying anyone, posting publicly, or sending a breach notice on the company's behalf without the approval this procedure requires, concealing a possible breach, or destroying evidence may result in disciplinary action, up to and including termination of employment or of a contract, consistent with applicable law. This does not limit the Protected Reports section.

Nothing in this document prohibits or restricts anyone from reporting a possible violation of law to, filing a charge or complaint with, communicating with, or taking part in an investigation by any government agency, including law enforcement, the U.S. Department of Health and Human Services, the Securities and Exchange Commission, the National Labor Relations Board, or a state attorney general, or from making any other disclosure protected by law. No approval is needed for these reports, and no one will be disciplined for making one in good faith.

I have read the [Company Name] Data Breach Notification Procedure and I understand my role in it. I will record facts as I learn them, preserve evidence, and not notify anyone or make any public statement about a possible breach without the approval this procedure requires, except as allowed under the Protected Reports section.

Approval. Sign below to approve this document for adoption by [Company Name] after it has been reviewed by your legal counsel. Until it is signed, it is a draft and is not in effect.

Revision history. Record every change to this procedure below. Increase the document version and obtain approval again each time the procedure is revised.

This document was generated from a starter template provided by Preferred Data Corporation. It is general information only. It is not legal advice and it is not a substitute for advice from a licensed attorney. Using the template does not create an attorney-client, consulting, or other professional relationship.

Preferred Data Corporation is not a law firm or an insurer. It makes no representation that this document is complete, current, or suitable for any particular organization, industry, jurisdiction, or regulatory requirement. To the fullest extent permitted by law, it is not responsible or liable for any loss or damage arising from the use of this template or of any policy created from it. You are solely responsible for how you adapt, adopt, and enforce it.

Laws, regulations, insurance requirements, and contracts that apply to your organization may require different or additional terms. The facts, deadlines, and legal references in this template were checked against their sources on the date shown as "Template content last reviewed" in Document Control, not on the effective date, and may have changed since. Before you adopt, publish, or rely on this document, and in every case where you have a legal, regulatory, or contractual obligation, have it reviewed by qualified legal counsel.

In an actual security incident or data breach, contact your attorney, your cyber insurer, and law enforcement where appropriate. Do not rely on this template alone to decide whether, when, or how to notify anyone.

If Preferred Data Corporation prepared this document for you as part of its services, your service agreement governs those services. The content of this document is still general information and should be reviewed by your own counsel before you adopt it.

This template is provided "as is", without warranties of any kind, including accuracy, completeness, or fitness for a particular purpose. Links to laws, agencies, and other websites are provided for convenience and may change. Use of this template is also subject to the Website and Free Resources Disclaimer and the Terms of Service at preferreddata.com/legal/disclaimer and preferreddata.com/legal/terms-of-service.

To report an error, contact Preferred Data Corporation at preferreddata.com/contact or (336) 886-3282 and include the Document ID shown in Document Control. Corrections are listed in the template changelog on the template's page at preferreddata.com/policy-templates.