Law / United States / North Carolina
Identity Theft Protection Act, destruction of personal information records
N.C. Gen. Stat. section 75-64 (Chapter 75, Article 2A, added by S.L. 2005-414, s. 1)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force since 1 December 2005.
A security baseline statutes rule binding private bodies.
As of 15 September 2026.
What it requires
- This binds any business that conducts business in North Carolina, or that maintains or otherwise possesses personal information of a North Carolina resident, when the business or a records-destruction vendor it uses disposes of records containing that information; a bank or financial institution already complying with the Gramm-Leach-Bliley Act's privacy and security provisions, a HIPAA-compliant health insurer or health care facility, and a consumer reporting agency already complying with the Fair Credit Reporting Act are each excepted.
- Take reasonable measures to protect against unauthorized access to or use of personal information in connection with or after its disposal: burn, pulverize, or shred paper records, and destroy or erase electronic and other nonpaper media, so the information cannot practicably be read or reconstructed, under written policies that describe the destruction procedure and are monitored for compliance.
- Where a records-destruction vendor is used, conduct due diligence before contracting with it, such as reviewing an independent audit of the vendor's operations, checking its trade certification, or evaluating its information-security procedures, and monitor its ongoing compliance.
- A person injured by a violation may bring a civil action under G.S. 75-16 for treble the damages found; treble damages for a nonmanagerial employee's own acts or omissions apply only if the business was negligent in training, supervising, or monitoring that employee, and the Attorney General may also sue to enjoin a violation as an unfair or deceptive trade practice under G.S. 75-1.1.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Who enforces it
Enforcement body
No dedicated regulator. A violation is a deemed violation of the state's general unfair-or-deceptive-trade-practices statute, G.S. 75-1.1, enforceable by a person injured under G.S. 75-16 for treble damages, or by the North Carolina Attorney General, who may sue to enjoin the violation and, under G.S. 75-15.1, obtain restoration of property or cancellation of a contract obtained through it.
What it reaches
Obligation class
Security, Retention
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Any business that conducts business in North Carolina, or that maintains or otherwise possesses the personal information of a North Carolina resident, must take reasonable measures to protect against unauthorized access to or use of that information in connection with or after its disposal.
Required measures include burning, pulverizing, or shredding paper records so the information cannot practicably be read or reconstructed, and destroying or erasing electronic and other nonpaper media the same way. "Business" excludes any government or governmental subdivision or agency.
The duty also does not apply to a bank or financial institution already complying with the Gramm-Leach-Bliley Act, a HIPAA-compliant health insurer or health care facility, or a consumer reporting agency already complying with the Fair Credit Reporting Act. A violation is a deemed violation of G.S. 75-1.1, enforceable by a person injured under G.S. 75-16 for treble damages or by the Attorney General to enjoin the violation.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreachhigh_risk_decisionsprocesses_voiceprocesses_biometricsserves_minorsoperates_social_platformships_mobile_appdistributes_software_product