Data breach notification
North Carolina's Identity Theft Protection Act addresses security breaches at N.C. Gen. Stat. §§ 75-61 and 75-65.
North Carolina's rule is not limited to computerized data. A business that owns or licenses personal information in any form, whether computerized, paper, or otherwise, shall provide notice to the affected person following discovery or notification of a security breach.
Printed records holding names and identifying information therefore sit under the same section as a database does. Businesses that keep both kinds should look at both when an incident happens.
A security breach is an incident of unauthorized access to and acquisition of unencrypted and unredacted records or data containing personal information. It also needs a consequence: illegal use of the personal information has occurred or is reasonably likely to occur, or the incident creates a material risk of harm to a consumer.
So the harm test sits inside the definition itself. Records that were encrypted, or redacted, fall outside it.
Personal information is a person's first name or first initial and last name in combination with identifying information as defined in G.S. 14-113.20(b). That list lives in a different chapter, and the text we checked for this page does not quote it, so we do not repeat the elements here.
| Recipient | Timing |
|---|---|
| Affected persons | Without unreasonable delay. |
| Consumer Protection Division of the Attorney General's Office | Without unreasonable delay, whenever a business gives notice to an affected person. |
No day count appears in § 75-65 as read. The Division hears about every breach that produces notice to an affected person; the text we checked names no minimum number. The practical effect is that the resident letters and the report to the Division are prepared together, under the same standard of speed.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Watermarking is a per-room setting that is on by default. A reader confirms an email address with a six-digit code and needs no account, and groups are limited to their folders. For files kept in a ShareAndGo data room, the chained log and its CSV export give a North Carolina business a dated view history to work from.
Checked against North Carolina's published law on November 2, 2026. This is general information, not legal advice.
