North Carolina's data breach notification law, explained

Every business website that collects information from North Carolina residents sits under a statute most owners have never read until the day they need it. The notice statute (G.S. 75-65 — breach notification without unreasonable delay) requires a business that owns or licenses computerised personal information of state residents to notify the people affected by a security breach without unreasonable delay. The time to understand it is before the breach, not during it.

The first question is whether the data is covered at all, and the definition (G.S. 75-66 — what counts as personal information) is precise: a person's first name or initial and last name combined with any of a Social Security number; a driver's licence, state ID or passport number; a checking or savings account number; a credit or debit card number; a PIN; a digital signature; biometric data; fingerprints; or passwords. A mailing list of names and email addresses is not on that list. A booking system that stores names alongside card numbers or account passwords is.

The second is timing. The statute does not give a fixed number of days; it says without unreasonable delay, consistent with the legitimate needs of law enforcement and with the measures needed to determine the scope of the breach and restore the system's integrity. That is a standard, not a stopwatch. A business that spends a reasonable few days working out what happened is acting within it; one that waits months hoping the problem goes away is not.

The third is the one recognised reason to wait. Subsection (c) — the breach notice delay authorized provision — allows notice to be delayed if a law-enforcement agency tells the business that notifying would impede a criminal investigation or jeopardise national or homeland security. The request must be made in writing, or the business must document it in writing at the time. A phone call you did not write down is not a basis for delay.

What this means for how a site is built. The simplest protection is not collecting covered data: let a payment processor handle card numbers, avoid storing passwords you do not need, and delete form submissions once they have served their purpose. The Justice Department's position that the ADA applies to websites of public-facing businesses runs alongside this; a login or payment form rebuilt for security should be rebuilt accessibly at the same time.

And keep a record of what the site collects and where it is stored. When something goes wrong, that list is how you decide within days, not weeks, whether the statute has been triggered and who must be told.

Know which of the covered data types your site touches, collect as few as possible, and write down any law-enforcement request to delay. The statute asks for promptness and honesty; a site built to hold little makes both easy.