North Dakota Senate Bill SB2088

North Dakota 2025-2026 Regular Session

• Introduced: 1/7/25
• Refer: 1/7/25
• Report Pass: 1/29/25
• Engrossed: 2/3/25
• Refer: 2/18/25
• Report Pass: 3/17/25
• Enrolled: 3/24/25
• Passed: 3/26/25

Caption

AN ACT to amend and reenact subsection 4 of section 26.1-02.2-01, sections 26.1-02.2-05 and 26.1-02.2-07, and subsection 1 of section 26.1-02.2-08 of the North Dakota Century Code, relating to data security requirements for insurance producers; and to repeal section 26.1-02.2-11 of the North Dakota Century Code, relating to implementation dates for certain data security requirements for insurance producers.

Summary

SB 2088 updates North Dakota’s insurance data security law for insurance producers, insurers, and certain third-party service providers. The bill revises the definition of a “cybersecurity event,” clarifies when encrypted data incidents are excluded, and tightens the timing and content of required notices to the Insurance Commissioner when nonpublic information is involved. It generally requires prompt notice within three business days after a qualifying event is determined, and it expands the list of information that must be reported, including the nature of the breach, affected consumers, remediation efforts, and whether law enforcement or other regulators were notified. The bill also addresses cybersecurity events involving third-party service providers, assuming insurers, and insurers that use independent insurance producers. In those cases, it allocates notice responsibilities among the parties and requires insurers to notify producers of record when consumer notice is required. The bill preserves the requirement to comply with North Dakota’s consumer breach-notification law, chapter 51-30, and it repeals a prior implementation-date section that is no longer needed. It also updates confidentiality provisions governing information shared with the commissioner and other regulators, and it maintains certain exemptions for smaller licensees and entities already subject to HIPAA-compliant privacy and security rules.

Impact

SB 2088 amends chapter 26.1-02.2 of the North Dakota Century Code, which governs insurance data security requirements. Its practical effect is to refine reporting obligations, clarify who must notify whom after a cybersecurity event, and strengthen the commissioner’s oversight by requiring more detailed incident reporting and updated follow-up notices. It also preserves confidentiality protections for materials submitted during investigations and allows sharing with other regulators, law enforcement, and consultants under confidentiality agreements. Affected parties include insurers, insurance producers, assuming insurers, ceding insurers, third-party service providers, and consumers whose nonpublic information may be compromised.

Sentiment

The bill appears to have been received favorably and passed with overwhelming support. It cleared the Senate 43-1 and the House 93-0, indicating broad bipartisan agreement that the changes were needed. The absence of committee transcript material suggests there was little recorded public controversy or, at minimum, no significant opposition captured in the available record.

Contention

The main policy issues in the bill are not about whether cybersecurity reporting should exist, but about how quickly and by whom notice must be given, especially when third-party service providers or assuming insurers are involved. Another point of potential concern is the balance between transparency and confidentiality: the bill expands reporting to the commissioner while preserving strong confidentiality protections for submitted materials. The limited exemptions for smaller licensees and for entities already covered by HIPAA-related federal rules may also be relevant, but the recorded votes suggest these provisions were not especially contentious.