What is the data breach notification deadline in North Carolina?

North Carolina requires notice to affected individuals in the most expedient time possible and without unreasonable delay (N.C. Gen. Stat. §§75-61, 75-65).

Do you have to notify the North Carolina Attorney General of a data breach?

Yes. North Carolina Attorney General (Consumer Protection Division) must be notified.

← All jurisdictions

NC · data breach notification

North Carolina

med

N.C. Gen. Stat. §§75-61, 75-65

Individual deadline

No fixed limit

Trigger standard

Any breach

AG / regulator

Required

Notice to individuals	in the most expedient time possible and without unreasonable delay
Risk-of-harm standard	None, notice required on any qualifying breach of covered personal information.
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	North Carolina Attorney General (Consumer Protection Division), required for any affected resident; without unreasonable delay CPD reporting form
Credit reporting agencies	Notify CRAs above 1,000 residents.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	Yes.
Penalties	UDAP enforcement; private action via §75-1.1

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a North Carolina breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →