1. Home
  2. State breach laws
  3. North Dakota

North Dakota data breach notification law

What North Dakota requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by N.D. Cent. Code §§ 51-30-01 to 51-30-07 (notification at § 51-30-02).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

North Dakota sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required once 250 or more residents are affected, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent North Dakota breach filings →

Requirements in detail

Statute
N.D. Cent. Code §§ 51-30-01 to 51-30-07 (notification at § 51-30-02)
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice may be delayed at a law enforcement agency's request or for measures needed to determine the scope of the breach and restore the system.
Attorney General notification
Yes, by mail or email if the breach involves more than 250 individuals, on the same most-expedient-time timeline. The general breach law has no consumer reporting agency requirement. Since August 1, 2025, financial corporations regulated by the Department of Financial Institutions must also notify the Commissioner of Financial Institutions within 45 days of discovering a breach involving at least 500 consumers.
Penalties
The Attorney General enforces the law, and a violation is treated as a violation of the state's consumer fraud law. Courts can impose civil penalties of up to $5,000 per violation, plus injunctions and other remedies.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
North Dakota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. North Dakota has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
HB 1127 (signed April 11, 2025, effective August 1, 2025) created a separate data security law for financial corporations regulated by the Department of Financial Institutions. It requires notice to the Commissioner of Financial Institutions within 45 days of discovering a notification event involving at least 500 consumers. The general breach notification chapter (51-30) was not changed.

North Dakota breach notification FAQ

What is the data breach notification deadline in North Dakota?

In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, with no fixed number of days. Notice may be delayed at a law enforcement agency's request or for measures needed to determine the scope of the breach and restore the system. The governing law is N.D. Cent. Code §§ 51-30-01 to 51-30-07 (notification at § 51-30-02).

Does North Dakota require notifying the Attorney General of a data breach?

Yes, by mail or email if the breach involves more than 250 individuals, on the same most-expedient-time timeline. The general breach law has no consumer reporting agency requirement. Since August 1, 2025, financial corporations regulated by the Department of Financial Institutions must also notify the Commissioner of Financial Institutions within 45 days of discovering a breach involving at least 500 consumers.

What are the penalties for failing to report a data breach in North Dakota?

The Attorney General enforces the law, and a violation is treated as a violation of the state's consumer fraud law. Courts can impose civil penalties of up to $5,000 per violation, plus injunctions and other remedies.

Can individuals sue over a data breach in North Dakota?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in North Dakota?

North Dakota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does North Dakota limit breach lawsuits for companies with a cybersecurity program?

No. North Dakota has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the North Dakota Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →