North Carolina data breach notification law and cyber insurance

What the statute requires

North Carolina requires businesses to notify affected residents and the Attorney General of breaches of unencrypted personal information without unreasonable delay. Cyber liability insurance typically covers the forensics, notification, and legal review this statute requires.

Consumer notification deadline

Without unreasonable delay

Regulator notice

Notify the North Carolina Attorney General's Consumer Protection Division without unreasonable delay.

Credit bureau notice

Notify consumer reporting agencies when a breach requires notice to more than 1,000 residents.

Safe harbor

Notification is not required if the compromised data was encrypted and the confidential key was not acquired.

Enforcement

Violations are unfair or deceptive trade practices enforceable by the Attorney General, and affected residents may recover damages.

Statutes and sources

• North Carolina Identity Theft Protection Act

  N.C. Gen. Stat. sect. 75-61 et seq.

Regulator: North Carolina Department of Justice . Last verified 2026-07-29 from the official source .

Cyber Liability in other states

• Alabama
• Alaska
• Arizona
• Arkansas
• California
• Colorado
• Connecticut
• Delaware
• District of Columbia
• Florida
• Georgia
• Hawaii
• Idaho
• Illinois
• Indiana
• Iowa
• Kansas
• Kentucky
• Louisiana
• Maine
• Maryland
• Massachusetts
• Michigan
• Minnesota
• Mississippi
• Missouri
• Montana
• Nebraska
• Nevada
• New Hampshire
• New Jersey
• New Mexico
• New York
• North Dakota
• Ohio
• Oklahoma
• Oregon
• Pennsylvania
• Rhode Island
• South Carolina
• South Dakota
• Tennessee
• Texas
• Utah
• Vermont
• Virginia
• Washington
• West Virginia
• Wisconsin
• Wyoming

Back to the cyber liability coverage guide