North Carolina

The law requires any business that owns or licenses personal information of residents of North Carolina to provide notice to the affected person following the discovery or notifications of a security breach. The notice must be clear and conspicuous and must include the following:

1. A description of the incident in general terms.
2. A description of the type of personal information that was subject to the unauthorized access and acquisition.
3. A description of the general acts of the business to protect the personal information from further unauthorized access.
4. A telephone number for the business that the person may call for further information and assistance, if one exists.
5. Advice that directs the person to remain vigilant by reviewing account statements and monitoring free credit reports.
6. The toll‑free numbers and addresses for the major consumer reporting agencies.
7. The toll‑free numbers, addresses, and Web site addresses for the Federal Trade Commission and the North Carolina Attorney General's Office, along with a statement that the individual can obtain information from these sources about preventing identity theft.

The law applies only to North Carolina residents. Includes a person's first or last name in combination with:

1. Social Security number,
2. Employers taxpayer ID number,
3. Drivers license,
4. State ID card, or
5. Passport number,
6. Checking or savings account number, credit or debit card number, PIN code, electronic ID number, electronic mail names or addresses, internet account number, internet ID names, digital signatures,
7. Any other numbers or info that can be used to access a person's financial resources, biometric data, fingerprints, passwords, and parent’s legal surname prior to marriage.