North Carolina G.S. 75-65: Notice for Records in Any Form and a Report to the Attorney General Each Time

A Definition Assembled From Three Statutes

G.S. 75-60 names Article 2A of Chapter 75 the "Identity Theft Protection Act." The breach section does not supply its own list of covered data. Instead, G.S. 75-61(10) defines personal information as a first name or initial and last name combined with "identifying information as defined in G.S. 14-113.20(b)," which is the definition in North Carolina's criminal identity theft offense. Directories to which an individual consented and information lawfully available from government records are excluded.

That criminal definition is long. It covers Social Security and employer taxpayer identification numbers; driver's license, state identification and passport numbers; checking and savings account numbers; credit and debit card numbers; personal identification codes; digital signatures; biometric data and fingerprints; and any other numbers or information usable to access a person's financial resources. It also lists electronic identification numbers, email names or addresses, internet account numbers, internet identification names, passwords and a parent's legal surname before marriage.

Section 75-65(a) then takes that last group back out for breach purposes unless the item "would permit access to a person's financial account or resources." A password standing alone, in other words, is not covered merely because it was exposed. The result is a data list drawn from one statute, narrowed by a second and attached to a trigger set by a third.

Paper, and the Words That Reach It

The duty in subsection (a) falls on "any business that owns or licenses personal information of residents of North Carolina or any business that conducts business in North Carolina that owns or licenses personal information in any form (whether computerized, paper, or otherwise)." The parenthetical appears in the second clause, but the definition backs it: a security breach under 75-61(14) concerns "records or data," and 75-61(12) defines records as "any material on which written, drawn, spoken, visual, or electromagnetic information is recorded or preserved, regardless of physical form or characteristics." A stolen file drawer sits within those words as readily as a server.

"Business" in 75-61(1) covers sole proprietorships, partnerships, corporations, associations and other groups, profit or nonprofit, and expressly includes financial institutions organized under any state, federal or foreign law. It "shall not include any government or governmental subdivision or agency." The Department of Justice's security breach page describes the duty as reaching businesses "and state and local government," a statement this post could not trace to section 75-65, which is addressed to businesses.

The Trigger Requires Harm as Well as Acquisition

Under 75-61(14), a security breach is "an incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information where illegal use of the personal information has occurred or is reasonably likely to occur or that creates a material risk of harm to a consumer." Two elements stack: access joined to acquisition, then a harm condition inside the definition. The Department's page paraphrases this as unauthorized access "or" acquisition, but the statutory text says and.

The Department has itself pointed at a gap in the definition. Its 2021 breach report said the Attorney General had "championed updating our Identity Theft Protection Act to ensure that these type of data breaches constitute a security breach under our state law," referring to ransomware attacks, without saying which element of the definition it had in mind. The history line on 75-61 ends with Session Law 2015-193, so no later amendment to the definition appears there.

Encrypted data is not automatically safe. The definition says access to and acquisition of "encrypted records or data containing personal information along with the confidential process or key shall constitute a security breach." Good faith acquisition by an employee or agent for a legitimate purpose is outside the definition if the information is not used for an unlawful purpose or further disclosed. Redaction, under 75-61(13), leaves no more than the last four digits of an identification number accessible.

Timing Without a Day Count

No number of days appears anywhere in 75-65. Subsection (a) requires notification "without unreasonable delay," subject to law enforcement needs and to measures "necessary to determine sufficient contact information, determine the scope of the breach and restore the reasonable integrity, security, and confidentiality of the data system." A business holding another's data under subsection (b) notifies the owner or licensee "immediately following discovery."

Law enforcement delay in subsection (c) is mandatory and paper-documented. Notice "shall be delayed" if an agency informs the business that notification may impede a criminal investigation or jeopardize national or homeland security, provided the request is written or the business documents it contemporaneously, naming the officer and the agency.

Seven Required Elements

Subsection (d) requires a notice that is "clear and conspicuous" and lists its contents:

1. a general description of the incident;
2. the type of personal information subject to unauthorized access and acquisition;
3. the general acts of the business to protect the information from further unauthorized access;
4. a telephone number for further information and assistance, if one exists;
5. advice to remain vigilant by reviewing account statements and monitoring free credit reports;
6. toll-free numbers and addresses for the major consumer reporting agencies; and
7. toll-free numbers, addresses and website addresses for the Federal Trade Commission and the North Carolina Attorney General's Office, with a statement that identity theft prevention information is available from them.

Under subsection (e), notice may be written, electronic where the person agreed to electronic communications and the delivery satisfies 15 U.S.C. 7001, or telephonic with direct contact. Substitute notice requires all of email, website posting and major statewide media. It is available above $250,000 in cost or 500,000 persons, or, for just the affected persons concerned, where contact information or consent is missing or particular persons cannot be identified.

Two Duties to the Consumer Protection Division

Subsection (e1) applies with no minimum count: "In the event a business provides notice to an affected person pursuant to this section," it notifies the Consumer Protection Division of the Attorney General's Office without unreasonable delay of the nature of the breach, the number of consumers affected, the steps taken to investigate it, the steps taken to prevent a similar breach, and the timing, distribution and content of the notice. That is a report about the incident as well as about the letter sent.

Subsection (f) is a second, narrower duty. When a business notifies more than 1,000 persons at one time, it also notifies the Division and all nationwide consumer reporting agencies of the timing, distribution and content of the notice. The Department takes reports through an online form.

Subsection (h) deems compliant a financial institution or credit union subject to and in compliance with the 2005 federal interagency guidance on response programs. Subsection (g) voids any waiver of the Article as contrary to public policy, and 75-65(j) says causes of action arising under the Article may not be assigned. Session Law 2025-25, section 29, the most recent item in the section's history, is a general style directive to the Revisor of Statutes replacing "e-mail" with "email" and changing the treatment of "Internet" and website terms across the General Statutes, not a change to the breach duty.

Chapter 75 Remedies

Section 75-65(i) places a breach failure inside the state's general unfair practices statute: "A violation of this section is a violation of G.S. 75-1.1." G.S. 75-1.1 declares unfair or deceptive acts in or affecting commerce unlawful. The same subsection then narrows private enforcement: "No private right of action may be brought by an individual for a violation of this section unless such individual is injured as a result of the violation."

An injured person's action runs through general Chapter 75 provisions. G.S. 75-16 provides that judgment shall be rendered for "treble the amount fixed by the verdict," and 75-16.1 allows the judge to award a reasonable attorney fee on the findings it lists. For the state, 75-14 authorizes actions for mandatory orders and injunctions, and 75-15.2 allows a civil penalty of up to $5,000 per violation where the acts were "knowingly violative of a statute."

What the Department of Justice Publishes

The North Carolina Department of Justice site was reachable for this post, and it publishes both counts and matters. Its 2025 report records 2,349 breaches reported that year, affecting 9,275,938 North Carolinians, and says hacking caused 77 percent of them. The same report says that since 2006 businesses have reported 19,318 breaches affecting 40,403,095 people; the security breach page says more than 20,000 since December 2005. The report also states that the Attorney General issued a Civil Investigative Demand to PowerSchool after its breach and that the investigation is ongoing.

No fetched document cites section 75-65 by number, so the record of actions under that section stands at zero for this post. Two matters show how the office has described breach claims. The North Carolina settlement agreement with Blackbaud, effective November 6, 2023, says the investigation examined compliance with the state's "data breach notification law" among others, requires compliance with that law "as applicable," and enters its injunctive terms under G.S. 75-14. A July 14, 2026 release on the 23andMe settlement states North Carolina's share as $666,242 without naming a state statute.

Frequently Asked Questions