# N.D. Cent. Code § 13-01.2-01: 13-01.2-01. Definitions > North Dakota · Statutes · In force URL: https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-01 ## Section - **Citation:** N.D. Cent. Code § 13-01.2-01 - **Heading:** 13-01.2-01. Definitions - **Jurisdiction:** North Dakota - **Kind:** Statutes - **Status:** In force - **Text as of:** August 14, 2026 - **Source:** Compiled text - **Location:** ND Code / Title 13 / Chapter 13-01.2 / Section 13-01.2-01 ## Text 13-01.2-01. Definitions For purposes of this chapter, the following definitions shall apply: 1. "Authorized user" means any employee, contractor, agent, or other person who: a. Participates in a financial corporation's business operations; and b. Is authorized to access and use any of the financial corporation's information systems and data. 2. "Commissioner" means the commissioner of the department of financial institutions. 3. "Consumer": a. Means an individual, or that individual's legal representative, who applies for or has obtained a financial product or service from a financial corporation which is to be used primarily for personal, family, or household purposes. A consumer includes an individual who: (1) Applies to a financial corporation for credit for personal, family, or household purposes, regardless of whether the credit is extended. (2) Provides nonpublic personal information to a financial corporation to obtain a determination about whether the applicant may qualify for a loan to be used primarily for personal, family, or household purposes, regardless of whether the loan is extended. (3) Provides nonpublic personal information to a financial corporation in connection with obtaining or seeking to obtain financial, investment, or economic advisory services, regardless of whether the financial corporation establishes a continuing advisory relationship. (4) Has a loan for personal, family, or household purposes in which the financial corporation has ownership or servicing rights, even if the financial corporation or one or more other corporations that hold ownership or servicing rights in conjunction with the financial corporation hires an agent to collect on the loan. b. Does not include an individual who: (1) Uses a different financial corporation or financial institution to act solely as an agent for, or provide processing or other services to, the individual financial corporation or financial institution. (2) Designates a financial corporation solely for the purposes to act as trustee for a trust. (3) Is a beneficiary of a trust for which the financial corporation is a trustee. (4) Is a participant or a beneficiary of an employee benefit plan that the financial corporation sponsors or for which the financial corporation acts as a trustee or fiduciary. 4. "Continuing relationship": a. Means a situation in which a consumer: (1) Has a credit or investment account with a financial corporation; (2) Obtains a loan from a financial corporation; (3) Purchases an insurance product from a financial corporation; (4) Holds an investment product through a financial corporation, including when a financial corporation acts as a custodian for securities or for assets in an individual retirement arrangement; (5) Enters into an agreement or understanding with a financial corporation in which the financial corporation undertakes to arrange or broker a home mortgage loan, or credit to purchase a vehicle, for the consumer; (6) Enters into a lease of personal property on a nonoperating basis with a financial corporation; (7) Obtains financial, investment, or economic advisory services from a financial corporation for a fee; (8) Becomes a financial corporation's client for the purpose of obtaining tax preparation or credit counseling services from the financial corporation; (9) Obtains career counseling while: (a) Seeking employment with a financial corporation or the finance, accounting, or audit department of any company; or ial, investment, or economic advisory services from a financial corporation for a fee; (8) Becomes a financial corporation's client for the purpose of obtaining tax preparation or credit counseling services from the financial corporation; (9) Obtains career counseling while: (a) Seeking employment with a financial corporation or the finance, accounting, or audit department of any company; or (b) Employed by a financial corporation or department of any company; (10) Is obligated on an account that a financial corporation purchases from another financial corporation, regardless of whether the account is in default when purchased, unless the financial corporation does not locate the consumer or attempt to collect any amount from the consumer on the account; (11) Obtains real estate settlement services from a financial corporation; or (12) Has a loan for which a financial corporation owns the servicing rights. b. Does not include a situation in which: (1) The consumer obtains a financial product or service from a financial corporation only in isolated transactions, including: (a) A financial corporation's automated teller machine to withdraw cash from an account at another financial institution; (b) Purchasing a money order from a financial corporation; (c) Cashing a check with a financial corporation; or (d) Making a wire transfer through a financial corporation; (2) A financial corporation sells the consumer's loan and does not retain the rights to service that loan; (3) A financial corporation sells the consumer an airline ticket, travel insurance, or a traveler's check in isolated transactions; (4) The consumer obtains one-time personal or real property appraisal services from a financial corporation; or (5) The consumer purchases checks for a personal checking account from a financial corporation. 5. "Customer" means a consumer who has a customer relationship with a financial corporation. 6. "Customer information" means any record containing nonpublic personal information about a customer of a financial corporation, whether in paper, electronic, or other form, which is handled or maintained by or on behalf of the financial corporation or the financial corporation's affiliates. 7. "Customer relationship" means a continuing relationship between a consumer and a financial corporation under which the financial corporation provides one or more financial products or services to the consumer that are used primarily for personal, family, or household purposes. 8. "Encryption" means the transformation of data into a form that results in a low probability of assigning meaning without the use of a protective process or key, consistent with current cryptographic standards and accompanied by appropriate safeguards for cryptographic key material. 9. "Financial corporation" means all entities regulated by the department of financial institutions, excluding financial institutions and credit unions. 10. "Financial institution" means any bank, industrial loan company, or savings and loan association organized under the laws of this state or of the United States. 11. "Financial product or service" means any product or service that a financial holding company could offer by engaging in a financial activity under the federal Bank Holding Company Act of 1956 [12 U.S.C. 1843 section 4(k)]. The term includes a financial corporation's evaluation or brokerage of information that a financial corporation collects in connection with a request or an application from a consumer for a financial product or service. 12. "Information security program" means the administrative, technical, or physical safeguards a financial corporation uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information. 13. "Information system" means a discrete set of electronic information resources application from a consumer for a financial product or service. 12. "Information security program" means the administrative, technical, or physical safeguards a financial corporation uses to access, collect, distribute, process, protect, store, use, transmit, dispose of, or otherwise handle customer information. 13. "Information system" means a discrete set of electronic information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of electronic information, as well as any specialized system, including industrial process controls systems, telephone switching and private branch exchange systems, and environmental controls systems that contain customer information or that is connected to a system that contains customer information. 14. "Multifactor authentication" means authentication through verification of at least two of the following types of authentication factors: a. Knowledge factors, including a password; b. Possession factors, including a token; or c. Inherence factors, including biometric characteristics. 15. "Nonpublic personal information": a. Means: (1) Personally identifiable financial information; and (2) Any list, description, or other grouping of consumers, including publicly available information pertaining to the consumers that is derived using personally identifiable financial information that is not publicly available, including account numbers. b. Does not include: (1) Publicly available information, except as included on a list described in paragraph 2 of subdivision a; (2) Any list, description, or other grouping of consumers, including publicly available information pertaining to the consumers that is derived without using any personally identifiable financial information that is not publicly available; or (3) Any list of individuals' names and addresses that contains only publicly available information, is not derived, in whole or in part, using personally identifiable financial information that is not publicly available, and is not disclosed in a manner that indicates that any individual on the list is the financial corporation's consumer. 16. "Notification event" means the acquisition of unencrypted customer information without the authorization of the individual to which the information pertains. Customer information is considered unencrypted for purposes of this subsection if the encryption key was accessed by an unauthorized person. Unauthorized acquisition is presumed to include unauthorized access to unencrypted customer information unless the financial corporation has reliable evidence showing there has not been, or could not reasonably have been, unauthorized acquisition of customer information. 17. "Penetration testing" means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system by attempting to penetrate databases or controls from outside or inside a financial corporation's information systems. 18. "Personally identifiable financial information": a. Means any information: (1) A consumer provides to a financial corporation to obtain a financial product or service; (2) About a consumer resulting from any transaction involving a financial product or service between a financial corporation and a consumer; or (3) A financial corporation otherwise obtains about a consumer in connection with providing a financial product or service to that consumer. b. Includes: (1) Information a consumer provides to a financial corporation on an application to obtain a loan, credit card, or other financial product or service; (2) Account balance information, payment history, overdraft history, and credit or debit card purchase information; (3) An individual that is or has been a financial corporation's customer or has obtained a financial product or service from the financial corporation; mer provides to a financial corporation on an application to obtain a loan, credit card, or other financial product or service; (2) Account balance information, payment history, overdraft history, and credit or debit card purchase information; (3) An individual that is or has been a financial corporation's customer or has obtained a financial product or service from the financial corporation; (4) Any information about a financial corporation's consumer if it is disclosed in a manner that indicates the individual is or has been a financial corporation's consumer; (5) Any information a consumer provides to a financial corporation or which a financial corporation or a financial corporation's agent otherwise obtains in connection with collecting on, or servicing, a credit account; (6) Any information a financial corporation collects through an information collecting device from a web server; and (7) Information from a consumer report. c. Does not include: (1) A list of names and addresses of customers of an entity that is not a financial corporation; and (2) Information that does not identify a consumer, such as aggregate information or blind data that does not contain personal identifiers such as account numbers, names, or addresses. 19. a. "Publicly available information": (1) Means any information that a financial corporation has a reasonable basis to believe is lawfully made available to the general public from: (a) Federal, state, or local government records; (b) Widely distributed media; or (c) Disclosures to the general public which are required under federal, state, or local law. (2) Includes information: (a) In government real estate records and security interest filings; or (b) From widely distributed media, a telephone book, a television or radio program, a newspaper, or a website that is available to the general public on an unrestricted basis. A website is not restricted because an internet service provider or a site operator requires a fee or a password, provided access is available to the general public. b. For purposes of this subsection, a financial corporation has a reasonable basis to believe information is lawfully made available to the general public if the financial corporation has taken steps to determine: (1) The information is of the type available to the general public; and (2) Whether an individual can direct that the information not be made available to the general public and, if so, that the financial corporation's consumer has not done so. A financial corporation has a reasonable basis to believe mortgage information is lawfully made available to the general public if the financial corporation determines the information is of the type included on the public record in the jurisdiction where the mortgage is recorded. A financial corporation has a reasonable basis to believe an individual's telephone number is lawfully made available to the general public if the financial corporation has located the telephone number in the telephone book or the consumer has informed the financial corporation the telephone number is not unlisted. 20. "Qualified individual" means the individual designated by a financial institution to oversee, implement, and enforce the financial institution's information security program. 21. "Security event" means an event resulting in unauthorized access to, or disruption or misuse of: a. An information system or information stored on an information system; or b. Customer information held in physical form. 22. "Service provider" means any person or entity that receives, maintains, processes, or otherwise is permitted access to customer information through its provision of services directly to a financial corporation that is subject to this chapter. ## Nearby sections - [N.D. Cent. Code § 13-01.2-01 13-01.2-01. Definitions](https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-01.md) - [N.D. Cent. Code § 13-01.2-02 13-01.2-02. Standards for safeguarding customer information](https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-02.md) - [N.D. Cent. Code § 13-01.2-03 13-01.2-03. Elements of a security program](https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-03.md) - [N.D. Cent. Code § 13-01.2-04 13-01.2-04. Exemptions](https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-04.md) --- Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_ND_T13_C13-01.2_S13-01.2-01. Check the current official text before relying on it. Not legal advice.