{
 "jurisdiction_id": "US-ND",
 "jurisdiction": "United States – North Dakota",
 "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-06",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 22,
  "sub_modules": 57,
  "source_register": 13
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "amber",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "No omnibus statute exists (would be red for comprehensive-rights coverage), but a live, actively-amended breach-notification statute plus federal FTC Section 5 baseline provide a minimum enforceable floor, so amber rather than red.",
   "claims": [
    {
     "statement": "The North Dakota Attorney General is the state's primary consumer-protection enforcement authority for privacy-adjacent matters, operating under general state consumer-protection powers rather than a dedicated data-protection statute.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota has no comprehensive consumer-privacy statute; a 2019 comprehensive privacy bill (HB 1485) was substituted with a study task force rather than enacted into law.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://prod.iapp.org/media/pdf/State_Comp_Privacy_Law.pdf",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "FTC Act Section 5 unfair/deceptive-practices authority applies nationally, including to North Dakota, as the federal general-baseline privacy enforcement mechanism.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "Federal Trade Commission",
     "source_url": "https://www.ftc.gov/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's breach-notification statute defines 'personal information' to include online-account login credentials, an expansion added circa 2014-2015 alongside similar amendments in Florida, Nevada and Wyoming.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/states-continue-to-expand-definition-of-personal-information",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's breach law requires disclosure to affected North Dakota residents even where the disclosing entity does not otherwise conduct business in the state.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-breach-notification-amendment-bill-enacted",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's breach law includes a state Attorney General notification requirement where a breach affects more than 250 individuals.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-breach-notification-amendment-bill-enacted",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "red",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "No enumerated lawful bases, no general consent standard, no special-category regime, and no pseudonymisation/anonymisation safe-harbour exist at state level; only narrow sectoral opt-out rights apply.",
   "claims": [
    {
     "statement": "A proposed North Dakota opt-in consent law was voted down by a state House committee, leaving no general statutory opt-in consent requirement for commercial data collection.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/proposed-opt-in-law-voted-down-by-nd-house-committee",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "Insurance licensees in North Dakota are subject to NAIC-model privacy regulation provisions governing nonpublic personal health and financial information, implemented via a signed state NAIC-implementation bill, though the precise scope of ND's adoption could not be independently confirmed from the retrieved source content.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-governor-signs-naic-implementation-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "red",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "No comprehensive data-subject-rights regime exists at state level; only narrow federal sectoral rights apply, so red with absent_field_provenance.",
   "claims": [
    {
     "statement": "North Dakota's breach-notification statute imposes disclosure timelines on entities following discovery of a security breach, but does not establish a general subject-access-request response deadline.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-breach-notification-amendment-bill-enacted",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "Breach notification and narrow financial/insurance-sector security duties are in force (supporting amber), but no general accountability, DPIA, DPO, ROPA, or retention regime exists (which alone would justify red) for non-sectoral controllers.",
   "claims": [
    {
     "statement": "North Dakota enacted legislation on student-data-sharing agreements, governing data-sharing relationships between educational institutions and third-party providers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-bill-student-data-sharing-agreements",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's Governor signed a bill implementing an NAIC model law affecting insurance-sector data-security obligations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-governor-signs-naic-implementation-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota enacted an act addressing financial-institution data security obligations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-act-financial-institution-data-security",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's 2015 breach-notification amendment expanded notification requirements and the range of businesses subject to them, requiring disclosure to affected residents and, for breaches over 250 individuals, to the Attorney General.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-breach-notification-amendment-bill-enacted",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "red",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "No state-level transfer mechanism, adequacy status, or localisation rule exists; this module is a genuine regulatory gap for the ND JID specifically.",
   "claims": []
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Multiple sectoral overlays are confirmed in force (financial, insurance, education), but health, telecoms, employment, and credit-scoring show no ND-specific overlay — hence amber rather than green.",
   "claims": [
    {
     "statement": "North Dakota enacted an act addressing financial-institution data security, supplementing federal GLBA obligations for financial institutions in the state.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-act-financial-institution-data-security",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "The North Dakota Board of Higher Education passed a policy implementing guidelines on the collection, use and access of students' personally identifiable information and prohibiting the state's public colleges from selling student data for advertising purposes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/nd-passes-policy-to-protect-student-data-privacy/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota enacted legislation governing student-data-sharing agreements between local education agencies and third-party service providers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-bill-student-data-sharing-agreements",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's Governor signed a bill implementing an NAIC model law relevant to insurance-sector data handling and security obligations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-governor-signs-naic-implementation-bill",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No state adtech/commercial-privacy statute exists; the sole legislative attempt failed, confirming a genuine gap rather than an unresearched absence.",
   "claims": [
    {
     "statement": "A proposed North Dakota opt-in consent law affecting commercial data/marketing practices was voted down by a state House committee, leaving no state-level opt-in marketing-consent requirement.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/proposed-opt-in-law-voted-down-by-nd-house-committee",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "red",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "No ND-specific algorithmic, biometric, genetic, or surveillance-governance statute was identified in this research pass; this is a confirmed regulatory gap, not an unresearched one.",
   "claims": []
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "amber",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "Education-settings protections are confirmed in force (supporting amber), but age-verification, parental-consent-beyond-COPPA, minor-profiling bans, and dependent-adults protections show no ND-specific coverage.",
   "claims": [
    {
     "statement": "The North Dakota Board of Higher Education passed a policy implementing guidelines on the collection, use and access of students' personally identifiable information and prohibited the state's 11 public colleges from selling data for advertising purposes.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/nd-passes-policy-to-protect-student-data-privacy/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota enacted legislation governing student-data-sharing agreements between local education agencies and third-party service providers.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/north-dakota-bill-student-data-sharing-agreements",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/united-states-north-dakota/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "A functioning AG enforcement channel plus federal FTC backstop exist (amber), but no ND-specific penalty schedule, private right of action, or class-action mechanism for privacy specifically was confirmed, and no recent (180-day) ND-specific enforcement activity was identified.",
   "claims": [
    {
     "statement": "The North Dakota Attorney General enforces the state's breach-notification statute and general consumer-protection law as the primary privacy-adjacent enforcement mechanism in the state.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "NAAG",
     "source_url": "https://www.naag.org/",
     "source_tier": null,
     "observed_at": "2026-08-06"
    },
    {
     "statement": "North Dakota's breach-notification statute is enforced by the Attorney General rather than through a private right of action, consistent with the majority pattern among US state breach-notification statutes.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker",
     "source_tier": null,
     "observed_at": "2026-08-06"
    }
   ]
  }
 ]
}