Licensing company data in North Carolina: the Identity Theft Protection Act
North Carolina has no comprehensive consumer privacy law. Its main data statute is the Identity Theft Protection Act, which governs breach notice and the handling of Social Security numbers. A company here licensing old records should know that act and should keep the numbers out.
Where North Carolina stands
| Question | Answer as of 2 November 2026 |
|---|---|
| Comprehensive privacy law | No. It is not on the list of enacted state laws kept by the tracker we checked on 2 November 2026. |
| Identity Theft Protection Act | General Statutes 75-60 and following. It covers breach notice, security freezes and limits on the use of Social Security numbers. |
| Breach notice | A business that suffers a breach notifies affected people and the Consumer Protection Division of the Attorney General’s office. |
| Recording calls | One-party consent under the state wiretap statute. |
Keep the numbers out
Operating records pick up Social Security numbers in places no one planned: a payroll question in a chat, a scanned form in a ticket, a loan file attached to an email. The act restricts how a business may use or share them, and a license of an archive that still has them runs into the statute and into the buyer’s own screening.
The standard fix is a scan before the export. Look for nine-digit patterns and the words next to them, remove what is found and keep the log of the scan.
Research and technology records
North Carolina has a large research and life science sector. A lab notebook, an assay record or a clinical operations file carries rules of its own, covered in the university and research lab and pharma pages. The state act does not change them.
Read next
- United States rules. The federal laws behind every state.
- Other states. What each state adds.
- De-identification. How personal detail comes out.
- Liability. Who answers for what in a deal.
Questions about licensing company data in North Carolina: the Identity Theft Protection Act
Who gets notified after a breach?
The affected people, and the Attorney General’s Consumer Protection Division, under the Identity Theft Protection Act.
Do Social Security numbers matter in a data license?
Yes. They should be found and removed before any export leaves the company.
Does North Carolina have a consumer privacy law in progress?
Bills have been introduced. None was on the enacted list of the tracker we checked.
Does a small business have to notify the Attorney General?
The act ties the notice to the breach, not to the size of the business. A company that must notify affected people also notifies the Consumer Protection Division, so a closing company with an old archive carries the same duty as an operating one.
Didn't find your question? Ask us directly.