What does North Carolina's data breach law ask a business to do?

Who does this law apply to?

The Attorney General's page says a business, state or local government agency that owns or licenses records or data with personal information must notify after a security breach. A business is covered if it is located in North Carolina or owns or licenses personal information of North Carolina residents.

A security breach, as the page describes it, is unauthorized access to or acquisition of unencrypted or unredacted personal information where illegal use has occurred or is reasonably likely, or that creates a material risk of harm.

A business, state or local government agency that owns or licenses records or data with personal information that has been subject to a security breach must notify.

The business must be (1) located in North Carolina or (2) own/license the personal information (in any form) of North Carolina residents.

A "security breach" is defined as the unauthorized access or acquisition of unencrypted or unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm.

What counts as personal information?

The page lists a Social Security number, an employer taxpayer identification number, a driver's licence or state ID number, a passport number, bank account and card numbers, a PIN, a digital signature, biometric data, fingerprints, and any number that can open a person's financial resources.

Personal information includes: an individual's Social Security number (SSN), employer taxpayer identification number (TIN), driver's license or state identification number, passport number, checking/saving account number, credit/debit card number, PIN, digital signature, biometric data, fingerprints or any number that can be used to access his financial resources.

How fast must people be told?

The page sets no fixed number of days. The notice must be clear and conspicuous and given without unreasonable delay, and may be delayed only at the request of law enforcement.

The notice must be clear and conspicuous and given without unreasonable delay. Notice can only be delayed at the request of law enforcement if it would harm a criminal investigation or national security.

Who else must be told?

Businesses and agencies must also report breaches to the Attorney General's Consumer Protection Division and to the three major consumer reporting agencies.

Businesses and state and local government agencies must also report security breaches to the Attorney General's Consumer Protection Division, as well as to the three major consumer reporting agencies.

Is encrypted information treated differently?

Yes. The page says acquiring encrypted data is a breach only if the confidential process or key that unlocks it is also breached.

The acquisition of encrypted data only is a breach if a confidential process or key needed to unlock the data is also breached.

What if a vendor holds the data?

A business that keeps personal information of North Carolina residents for another company must tell the owner or licensee immediately after discovering the breach.

Businesses that keep records/data with the personal information of North Carolina residents on behalf of another company must notify the owner or licensee of a security breach immediately following the discovery of the breach.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.