1. Home
  2. State breach laws
  3. North Carolina

North Carolina data breach notification law

What North Carolina requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.C. Gen. Stat. § 75-65 (definitions in § 75-61).

No fixed deadline
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

North Carolina requires notice to the Attorney General's Consumer Protection Division for every breach, with no minimum number of residents, and, unusually, lets injured consumers sue for treble damages under the Unfair and Deceptive Trade Practices statute. Litigation exposure changes the conversation: a North Carolina organization that just filed is thinking about how it will show reasonable security in front of a judge, which makes assessment work, documented controls, and incident-response retainers straightforward to position.

See recent North Carolina breach filings →

Requirements in detail

Statute
N.C. Gen. Stat. § 75-65 (definitions in § 75-61)
Deadline to notify residents
Without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice must be delayed if law enforcement asks in writing (or the request is documented) because notice could impede a criminal investigation or jeopardize national or homeland security.
Attorney General notification
Yes, whenever any affected person is notified, with no minimum number. The Consumer Protection Division of the Attorney General's Office must be told, without unreasonable delay, the nature of the breach, the number of consumers affected, the investigation and prevention steps, and the timing, distribution, and content of the notice. Consumer reporting agencies must also be notified without unreasonable delay when more than 1,000 people are notified at one time.
Penalties
A violation is an unfair or deceptive trade practice. In a suit by the Attorney General, courts can impose civil penalties of up to $5,000 per violation for knowing violations, and individuals injured by a violation can recover treble damages.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
North Carolina's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. North Carolina has no law limiting breach lawsuits for organizations that maintain a security program.

North Carolina breach notification FAQ

What is the data breach notification deadline in North Carolina?

Without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice must be delayed if law enforcement asks in writing (or the request is documented) because notice could impede a criminal investigation or jeopardize national or homeland security. The governing law is N.C. Gen. Stat. § 75-65 (definitions in § 75-61).

Does North Carolina require notifying the Attorney General of a data breach?

Yes, whenever any affected person is notified, with no minimum number. The Consumer Protection Division of the Attorney General's Office must be told, without unreasonable delay, the nature of the breach, the number of consumers affected, the investigation and prevention steps, and the timing, distribution, and content of the notice. Consumer reporting agencies must also be notified without unreasonable delay when more than 1,000 people are notified at one time.

What are the penalties for failing to report a data breach in North Carolina?

A violation is an unfair or deceptive trade practice. In a suit by the Attorney General, courts can impose civil penalties of up to $5,000 per violation for knowing violations, and individuals injured by a violation can recover treble damages.

Can individuals sue over a data breach in North Carolina?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in North Carolina?

North Carolina's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does North Carolina limit breach lawsuits for companies with a cybersecurity program?

No. North Carolina has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the North Carolina Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →