North Dakota Data Privacy and Security Law (Chapter 51-30)

Focuses primarily on data breach notification requirements. Requires businesses to notify affected individuals of security breaches involving personal information within 60 days. Includes specific requirements for substitute notice and content of notifications. Currently lacks comprehensive privacy rights but requires reasonable security measures for personal data protection.

JurisdictionNorth Dakota
CategoryPrivacy & Data Protection
StatusActive
Latest development

Analysis

Key Requirements

North Dakota's data privacy and security law (Chapter 51-30) primarily focuses on data breach notification requirements. The main requirements include:

  • Notification Timing: Businesses must notify affected North Dakota residents of a security breach "in the most expedient time possible and without unreasonable delay," within 60 days of discovery of the breach.
  • Notification Content: Notifications must include specific information about the breach, such as the types of personal information involved and steps individuals can take to protect themselves.
  • Substitute Notice: If direct notification costs would exceed $250,000 or the affected class exceeds 500,000 individuals, substitute notice methods are allowed, including email, website posting, and major statewide media notification.
  • Reasonable Security Measures: While not explicitly defined, the law implies that businesses must implement reasonable security procedures to protect personal information.

Compliance Challenges

Organizations face several challenges in complying with North Dakota's data breach law:

  • Determining Breach Scope: Quickly identifying affected individuals and the extent of compromised data can be difficult, as seen in the 2017 Equifax breach which affected 147 million consumers.
  • Meeting Notification Deadlines: The 60-day notification requirement can be challenging, especially for smaller businesses with limited resources. The 2013 Target data breach highlighted the difficulties in rapid breach response and notification.
  • Implementing "Reasonable" Security: The law's lack of specific security standards leaves room for interpretation, making it challenging for businesses to determine if their measures are sufficient.

Implementation Best Practices

To effectively implement North Dakota's data breach law requirements:

  • Develop an Incident Response Plan: Create and regularly test a comprehensive plan following frameworks like the NIST Cybersecurity Framework.
  • Implement Strong Data Protection: Use encryption, access controls, and regular security audits. The CIS Controls provide a prioritized set of actions to protect critical systems and data.

Recent Updates

As of March 2024, there have been no significant recent updates to North Dakota's data breach law. However:

  • The state legislature continues to study potential comprehensive privacy legislation, which could lead to future changes.

Related Regulations

North Dakota's data breach law interacts with several other regulations:

Industry Impact

The law's impact varies across industries:

  • Retail: Businesses handling large volumes of customer data face significant risks. The 2014 Home Depot breach affecting 56 million payment cards demonstrates the potential scale of retail breaches.
  • Healthcare: The healthcare sector must navigate both HIPAA and state requirements. A Ponemon Institute study found that healthcare data breaches cost an average of $9.23 million per incident in 2021.
  • Financial Services: Banks and credit unions face heightened scrutiny due to the sensitive nature of financial data. The American Bankers Association provides industry-specific cybersecurity resources.

Sources

Recent developments

  • — The North Dakota Century Code Chapter 51-30 remains the controlling breach-notification law, requiring notice to affected residents without unreasonable delay and notice to the attorney general when a breach affects more than 250 individuals. No newer statutory amendments appear in the code excerpt provided, indicating the core Chapter 51-30 rules remain in force. (source)
  • — A compliance guide summarized Chapter 51-30’s operational requirements, including notice timing, substitute notice conditions, and the rule that encryption can exempt a disclosure if the data or key were not compromised. This has continued relevance for organizations reviewing North Dakota breach-response procedures. (source)
  • — OneTrust DataGuidance noted that North Dakota’s school-district student data-sharing agreement policy took effect on July 1, 2026. The same jurisdictional update also confirmed that North Dakota still does not have a general consumer privacy law, so Chapter 51-30 remains the main statewide privacy-related statute for breach notification. (source)
  • — A legal update explained that H.B. 1127 largely mirrors the federal GLBA Safeguards Rule and clarified which entities are covered, including collection agencies, money transmitters, and mortgage servicers. The article also noted that North Dakota’s existing Chapter 51-30 breach-notification rules still apply separately to resident notifications and attorney general notice thresholds. (source)
  • — North Dakota enacted H.B. 1127, creating new security-program and breach-notification obligations for certain **financial corporations** regulated by the state’s Department of Financial Institutions. The law requires a comprehensive information-security program and notice to the department within 45 days for qualifying notification events involving at least 500 consumers. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates