Mandated Timeframe for Breach Reporting and/or Consumer Notification

Without unreasonable delay
Laws related specifically to personal information
  • Breach Reporting & Consumer Notification
  • Protect Personal Information
  • Program for Protection/Security
  • Third Party: Specific Obligations
  • Third Party: Mandated Contracts
  • Employee Training
  • Data Disposal/Destruction
  • Risk Assessment
  • Requests for Information
Fines & Penalties

Violations of breach and notification laws up to $5,000 per violation

Regulation Levels
  • Breach Reporting
  • Consumer Notifications
  • Third Party Management
  • Data Protection
  • None to minimal
  • Basic Requirements
  • Comprehensive Requirements
  • Extensive Requirements
Quick Facts
  • If notification is required to more than 250 persons, the state Attorney General must be notified either by mail or email.
  • There are specific considerations when determining if a breach is reportable.
  • North Dakota has a wide-ranging list of what they consider personally identifiable information (PII).
  • In addition to monetary civil penalties, the Attorney General may obtain injunctive relief through an action in a district court.
  • If a vendor is breached, they must report it to the data owner. The data owner will be responsible to complete the reporting and consumer notification.
  • If your breach affects residents in other states, you will need to notify those residents using those states’ rules.
Statutes and Laws
  • N.D. Cent. Code §§ 51-30-01 to 51-30-07 Notice Of Security Breach For Personal Information 

    N.D. Cent. Code § 51-15-07  Remedies – Injunction – Other relief – Receiver – Cease and desist orders – Civil penalties – Costs recoverable in adjudicative proceedings

    N.D. Cent. Code § 51-15-11  Civil penalties

    N.D. Cent. Code §§ 51-07-27 Restrictions on electronically printed credit card receipts ‑ Penalty

    N.D. Cent. Code §§ 23-01.3-01 – 23-01.3-09 Health Information Protection

    N.D. Cent. Code § 15.1-07-25.3  Protection of student data – School district policy

BAck to map