Skip to content
Network USA

NC · Breach notification statute

North Carolina data breach notification law

A summary of the North Carolina breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

N.C. Gen. Stat. §§ 75-60 to 75-66 (Identity Theft Protection Act) (amended 2009)

Last amended
2009 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

North Carolina

Attorney general notice

Yes North Carolina requires notification to the Consumer Protection Division of the Attorney General's

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationNo
Government ID numbersNot extracted
Paper recordsYes
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in North Carolina

210 reports to HHS OCR affecting 28,692,755 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in North Carolina.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Laboratory Corporation of America Holdings dba LabCorpHealthcare Provider10,251,784Jul 13, 2019Hacking/IT IncidentArchive (closed)
Lumexa ImagingHealthcare Provider5,830,949May 15, 2026Hacking/IT IncidentArchive (closed)
AccuDoc Solutions, Inc.Business Associate2,652,537Nov 27, 2018Hacking/IT IncidentArchive (closed)
Novant Health Inc.Business Associate1,362,296Aug 14, 2022Unauthorized Access/DisclosureArchive (closed)
US Radiology Specialists, Inc.Business Associate1,322,347Feb 18, 2022Hacking/IT IncidentArchive (closed)

Frequently asked questions

When must North Carolina businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the North Carolina timing rule as: "North Carolina". (Source: PRC 2026 survey extract.)

Does North Carolina require notice to the attorney general?

The PRC 2026 extract notes: "Yes North Carolina requires notification to the Consumer Protection Division of the Attorney General's". (Source: PRC 2026 survey extract.)

Does the North Carolina law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the North Carolina breach law.

Does the North Carolina law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the North Carolina breach law.

Does the North Carolina law cover paper records?

Yes. The PRC 2026 survey records paper (non-computerised) records as covered in North Carolina.

Is there a private right of action in North Carolina?

Yes. The PRC 2026 survey records a private right of action under the North Carolina breach law.

Is credit monitoring required in North Carolina?

No. The PRC 2026 survey does not record a credit monitoring requirement in North Carolina.

How does the North Carolina law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the North Carolina statute, and see our HIPAA vs state breach notification laws guide.

Sources