Skip to content
Network USA

ND · Breach notification statute

North Dakota data breach notification law

A summary of the North Dakota breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

N.D. Cent. Code §§ 51-30-01 to 51-30-07 (Notice of Security Breach for Personal Information) (amended 2015)

Last amended
2015 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

most expedient time possible and without unreasonable delay North Dakota requires persons

Attorney general notice

Yes North Dakota requires notification to the Attorney General by mail or email for breaches affecting

What counts as a breach

In North Dakota 'breach of the security system' means unauthorized acquisition of computerized data when access to personal information has not been secured by encryption or by any other method or technology that renders the electronic files, media, or databases unreadable or unusable. Good-faith acquisition of personal information by an employee or agent of the person is not a breach of the security of the system, if the personal information is not used or subject to further unauthorized disclo

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in North Dakota

21 reports to HHS OCR affecting 823,546 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in North Dakota.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Adaptive Health IntegrationsHealthcare Provider510,574Apr 11, 2022Hacking/IT IncidentArchive (closed)
Dakota Eye InstituteHealthcare Provider107,143Oct 23, 2023Hacking/IT IncidentArchive (closed)
DMS Health Technologies, Inc.Healthcare Provider48,336Jun 21, 2023Hacking/IT IncidentArchive (closed)
State of North DakotaHealthcare Provider35,416Oct 27, 2020Hacking/IT IncidentArchive (closed)
Heart of America Medical Center (“HAMC”)Healthcare Provider29,430Jul 1, 2025Hacking/IT IncidentUnder investigation

Frequently asked questions

When must North Dakota businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the North Dakota timing rule as: "most expedient time possible and without unreasonable delay North Dakota requires persons". (Source: PRC 2026 survey extract.)

Does North Dakota require notice to the attorney general?

The PRC 2026 extract notes: "Yes North Dakota requires notification to the Attorney General by mail or email for breaches affecting". (Source: PRC 2026 survey extract.)

Does the North Dakota law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the North Dakota breach law.

Does the North Dakota law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the North Dakota breach law.

Does the North Dakota law cover paper records?

No. The PRC 2026 survey records the North Dakota law as covering computerised data only, not paper records.

Is there a private right of action in North Dakota?

Yes. The PRC 2026 survey records a private right of action under the North Dakota breach law.

Is credit monitoring required in North Dakota?

No. The PRC 2026 survey does not record a credit monitoring requirement in North Dakota.

How does the North Dakota law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the North Dakota statute, and see our HIPAA vs state breach notification laws guide.

Sources