North Carolina data breach notification law: what small businesses must do

If your small business owns or licenses North Carolina residents' personal information and that data is breached, you usually must notify affected people without unreasonable delay, notify the North Carolina Attorney General when you send those notices, and notify nationwide consumer reporting agencies if more than 1,000 people are affected at one time.

Sources: N.C. Gen. Stat. 75-65, N.C. Gen. Stat. 75-61, North Carolina DOJ security breach guidance

The fast answer

North Carolina's breach law is broader than many owners expect.

It applies to a business that owns or licenses personal information of North Carolina residents, and also to a business that conducts business in North Carolina and owns or licenses that information in any form, including paper records. If you are a service provider holding someone else's data, you have a separate duty to notify the owner or licensee immediately after discovery, subject to any valid law-enforcement delay.

This is not a "wait for the forensics report to be perfect" statute. The standard is without unreasonable delay.

What North Carolina counts as a security breach

The definition starts in G.S. 75-61.

North Carolina treats a security breach as unauthorized access to and acquisition of unencrypted or unredacted records or data containing personal information when illegal use has occurred, is reasonably likely to occur, or creates a material risk of harm. Encrypted data can still count if the key or process needed to unlock it was also compromised.

The law also carves out one practical exception: a good-faith acquisition by an employee or agent for a legitimate business purpose is not a reportable breach if the information is not misused or further disclosed.

That matters because many small businesses discover incidents through an employee mistake first. Not every mistake is a statutory breach. But once unauthorized acquisition and real risk are on the table, the notice duties move quickly.

What counts as personal information

The statute's definition is not "any customer data."

G.S. 75-61 defines personal information around a person's name combined with identifying information, and G.S. 75-65 adds an important clarification for notice purposes: email addresses, internet account names, and passwords are not automatically covered unless they would permit access to a person's financial account or resources.

For a small business, the practical question is simple: did the exposed data make identity theft, account takeover, or financial fraud materially easier?

If the answer may be yes, stop debating labels and start working the response.

Who has to notify in North Carolina

There are really two tracks.

1. The business that owns or licenses the data

Under G.S. 75-65(a), that business must notify the affected person following discovery or notification of the breach. The notice must go out without unreasonable delay, while still allowing time to determine contact information, determine scope, and restore the integrity, security, and confidentiality of the system.

2. The business that only maintains or possesses the data

Under G.S. 75-65(b), a business that holds North Carolina residents' personal information for someone else must notify the owner or licensee of the information immediately following discovery of the breach, again subject to law-enforcement delay.

That is the part many MSPs, SaaS vendors, payroll processors, and outsourced back-office firms miss. If you are the custodian, you still have a breach-notice job to do.

North Carolina does not give you a fixed day count

Some states say 30 days, 45 days, or 60 days. North Carolina does not.

The statutory phrase is without unreasonable delay. That sounds flexible, but it is not a permission slip to stall. The law allows delay only for legitimate law-enforcement needs or for the practical work of determining who was affected, how broad the incident was, and how to restore the system.

In plain English: investigate fast, make the call, and move.

If you are waiting because nobody owns the incident, your legal clock problem is already operational.

What the notice to affected people must include

G.S. 75-65(d) is specific. The notice must be clear and conspicuous and include:

• A general description of the incident
• The type of personal information involved
• A general description of what you did to protect the information from further unauthorized access
• A business phone number for questions, if one exists
• Advice telling the person to remain vigilant by reviewing account statements and monitoring free credit reports
• The toll-free numbers and addresses for the major consumer reporting agencies
• The toll-free numbers, addresses, and website addresses for the FTC and the North Carolina Attorney General's Office, plus a statement that the individual can get identity-theft prevention information from those sources

This is one reason breach letters written in panic often fail. Owners focus on apology and forget the required consumer-help content.

How you can send the notice

North Carolina allows four notice methods:

• Written notice
• Electronic notice, if you have a valid email address and the person agreed to electronic communications
• Direct telephonic notice
• Substitute notice in limited circumstances

Substitute notice is not the normal path. Under G.S. 75-65(e), it is reserved for situations where notice would cost more than $250,000, the affected class exceeds 500,000 people, or you lack sufficient contact information or consent.

If you use substitute notice, it must include:

• Email notice when you have the address
• Conspicuous posting on your website, if you maintain one
• Notice to major statewide media

When the North Carolina Attorney General must be notified

This is the part many breach checklists leave out.

Under G.S. 75-65(e1), if you provide notice to an affected person under the statute, you must also notify the Consumer Protection Division of the Attorney General's Office without unreasonable delay. That notice must include:

• The nature of the breach
• The number of consumers affected
• Steps taken to investigate
• Steps taken to prevent a similar breach in the future
• Information about the timing, distribution, and content of the consumer notice

So for most reportable North Carolina breaches, the state notice is not optional or only for huge incidents. It is part of the base workflow.

When consumer reporting agencies must be notified

There is an added threshold in G.S. 75-65(f).

If you provide notice to more than 1,000 persons at one time, you must notify without unreasonable delay:

• The Consumer Protection Division of the Attorney General's Office
• All nationwide consumer reporting agencies described in 15 U.S.C. 1681a(p)

That notice must cover the timing, distribution, and content of the consumer notice.

This is separate from the regular Attorney General notice duty above. In practice, once the incident crosses 1,000 notices, you should treat regulator coordination as a dedicated workstream.

The five-part response order I would use

For a small business, the cleanest sequence is:

1. Contain the incident

Disable compromised accounts, isolate affected systems, preserve logs, and stop the bleeding first. If the event looks like ransomware or active compromise, this sits beside the immediate-response discipline in what to do in the first 24 hours after a small-business ransomware scare.

2. Decide whether the statute is triggered

Work from the legal definitions, not from gut feel. What data was involved? Was it unencrypted or was the key also exposed? Is illegal use reasonably likely or is there a material risk of harm?

3. Determine who owns the notice

If you are the data owner, your customer notice path starts. If you are a vendor holding someone else's data, your immediate owner-notification duty starts. Many incidents get delayed because nobody settles this distinction in the first few hours.

4. Build the notice package

Draft the consumer notice with every required element. Draft the Attorney General submission in parallel, not later.

5. Fix the control failure that caused the breach

The breach letter is not the project. The project is the control gap behind it. North Carolina DOJ's breach guidance makes clear that the state reviews notices and may investigate whether reasonable safeguards were in place. That turns the post-incident control story into a business risk, not just a technical one.

The same control families discussed in what controls do cyber insurers require in 2026 usually show up here too: MFA, endpoint detection, backup integrity, patching, and funds-transfer verification.

The mistakes that get small businesses in trouble

The pattern is usually not exotic.

Waiting for "perfect certainty"

North Carolina gives room for scope determination. It does not reward paralysis.

Treating the vendor contract as the whole answer

If your payroll processor, IT provider, ecommerce platform, or marketing stack was involved, the contract matters. It does not replace your own notice obligations.

Sending a thin breach letter

If the letter omits the statutory content, you have created a second problem.

Forgetting the Attorney General notice

This is probably the most common process miss for smaller firms without counsel or incident-response muscle.

Where Obsidian Ridge fits

We are not your lawyer, and this article is not legal advice.

Where we fit is the technical side of getting you from breach discovery to defensible facts: containment, log preservation, endpoint visibility, identity compromise review, and evidence of what actually happened. If your incident exposed how thin your control set is, the operational follow-on is usually some mix of managed detection and response, managed ITDR, and a tighter renewal posture before the next insurance application or claim discussion. Our cyber insurance readiness work often starts exactly there.

FAQ

Does North Carolina require a specific number of days for breach notice?

No. G.S. 75-65 uses a without-unreasonable-delay standard rather than a fixed number of days.

Do I have to notify the North Carolina Attorney General even if the breach is small?

Usually yes, if you are providing notice to affected people under G.S. 75-65. The statute's Attorney General notice duty is not limited only to mega-breaches.

When do I have to notify Equifax, Experian, and TransUnion?

When you provide notice to more than 1,000 people at one time. That triggers notice to nationwide consumer reporting agencies under G.S. 75-65(f).

What if my company only hosts or processes the data for someone else?

You still may have a statutory duty. Under G.S. 75-65(b), a custodian that does not own or license the information must notify the owner or licensee immediately following discovery, subject to law-enforcement delay.

Can I email the breach notice instead of mailing it?

Yes, but only if you have a valid email address and the person agreed to receive communications electronically. Otherwise use one of the other methods allowed by the statute.