North Carolina IT Asset Disposition (ITAD), Data Destruction, and Electronics Recycling Compliance

North Carolina’s Identity Theft Protection Act (N.C. Gen. Stat. § 75-60 to 75-66) couples a 30-day breach-notification deadline with a dedicated records-disposal duty, and the state’s Research Triangle biotech, banking, and federal-customer concentrations make hardware end-of-life destruction a frequent regulated event. Use the Enterprise Compliance Reference below as the North Carolina executive briefing; the sections that follow walk every duty, regulator, and penalty band with statute citation and recent Attorney General enforcement context.

North Carolina Enterprise Compliance Reference

North Carolina Compliance Reality

North Carolina’s privacy compliance regime is structured around the Identity Theft Protection Act (ITPA, N.C. Gen. Stat. Chapter 75, Article 2A), the records-destruction duty at G.S. 75-64, and the UDTPA carryover at G.S. 75-1.1. Retirement of a Retired Electronic Asset in North Carolina is governed by (1) G.S. 75-65, which requires breach notice to affected NC residents “without unreasonable delay” plus AG notice via the Consumer Protection Division form, (2) G.S. 75-61(10), which enumerates biometric data, fingerprints, employer taxpayer ID, parent’s legal surname before marriage, digital signatures, and the traditional name + SSN/DL/account-number framework as personal information, (3) G.S. 75-64, which prescribes reasonable measures including burning, pulverizing, or shredding paper records and destruction or erasure of electronic and nonpaper media so the information cannot practicably be read or reconstructed, (4) G.S. 130A-309 Part 2H, which establishes a manufacturer-takeback EPR program for computer equipment and televisions with annual registration fees ($2,500–$15,000) and a landfill ban effective July 1, 2011, (5) the NC DEQ-administered RCRA-delegated hazardous-waste program at 15A NCAC 13A, and (6) the universal-waste rules at 15A NCAC 13A .0119. Audit defensibility is the ability to reconstruct each step of asset retirement across that duty surface on demand.

North Carolina and Federal Compliance Interaction

North Carolina’s Charlotte banking center, Research Triangle biotech cluster, and Fort Liberty defense footprint pull HIPAA, GLBA, the FTC Safeguards Rule, FACTA, FAR 52.204-21, DFARS 252.204-7012, and CMMC 2.0 over most in-state enterprises, with N.C. Gen. Stat. § 75-65 layered on top. A regulated enterprise must satisfy the stricter of (1) North Carolina statutes including ITPA G.S. 75-65, records destruction G.S. 75-64, and the e-waste regime at G.S. 130A-309 Part 2H, (2) federal sector rules including the HIPAA Security Rule, the FTC Safeguards Rule, GLBA, FAR 52.204-21, and DFARS 252.204-7012, and (3) customer or prime-contract clauses. ITPA violations carry both AG enforcement and a private right of action with treble damages plus attorney fees under G.S. 75-16, creating a substantial layered exposure that does not exist in most other state regimes.

North Carolina Preemption Matrix (Federal Floor vs. State Posture)

The preemption matrix below states, for each federal regime that touches enterprise IT asset disposition in North Carolina, whether North Carolina law is preempted by, equal to, or exceeds the federal floor, and where it exceeds, the specific stricter element.

NIST SP 800-171 Revision 3 (May 2024 final) is the operative federal CUI sanitization baseline for federal-contractor environments, and CMMC 2.0 (32 CFR Part 170, effective December 16, 2024) is the operative DoD contractor framework that enforces the NIST 800-171 control set through assessment-based compliance levels. Federal contractors operating in North Carolina must satisfy CMMC 2.0 in addition to North Carolina state law.

North Carolina Data Security, Privacy, and Disposal Obligations

G.S. 75-65 — ITPA Breach Notification

N.C. Gen. Stat. § 75-65 requires any business that owns or licenses personal information of NC residents, upon discovery or notification of a security breach, to provide notice to the affected person without unreasonable delay, consistent with the legitimate needs of law enforcement and consistent with any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. G.S. 75-65(d) requires AG notice on the Consumer Protection Division’s online security breach notice form. G.S. 75-65(e) requires consumer reporting agency notice for breaches affecting more than 1,000 residents. ITPA violations carry UDTPA carryover liability under G.S. 75-1.1 with treble damages plus attorney fees under G.S. 75-16.

G.S. 75-61(10) — Personal Information (Biometric Overlay)

North Carolina’s “personal information” definition at G.S. 75-61(10) is unusually broad among state breach-notice regimes. It enumerates first name/initial + last name combined with SSN, driver’s license or state ID number, account number with code/password, biometric data, fingerprints, passwords, parent’s legal surname prior to marriage, employer taxpayer ID number, electronic identification numbers (with caveats), and digital signatures. Retired hardware that has processed biometric template files, fingerprint data, employer taxpayer IDs, or digital signatures triggers the § 75-65 notice duty when that data remains accessible after custody transfer. The audit-defensible posture is sanitization to NIST 800-88 Purge or Destroy before custody transfer.

G.S. 75-64 — Destruction of Personal Information Records

N.C. Gen. Stat. § 75-64 requires any business that conducts business in North Carolina or maintains or possesses personal information of NC residents to take reasonable measures to protect against unauthorized access to or use of the information in connection with or after its disposal. The reasonable measures must include (1) policies and procedures for burning, pulverizing, or shredding paper records so the information cannot be practicably read or reconstructed, (2) policies for destruction or erasure of electronic and nonpaper media containing personal information so the information cannot practicably be read or reconstructed, and (3) documentation of procedures as official policy in the writings of the business entity. G.S. 75-64(c) permits a written contract with a record-destruction business after due diligence, which may include reviewing an independent audit of the disposal business’s operations, obtaining references, or requiring certification by a recognized trade association.

North Carolina Public-Sector IT Disposal Posture

North Carolina state agencies retire IT assets under North Carolina Department of Information Technology policy. The operative controls include NCDIT Statewide Information Security Manual; State Surplus Property Agency; State Archives of North Carolina records retention schedules. Public-sector retirement requires permanent removal of data before transfer or surplus, documented chain of custody, records-retention-schedule alignment for any records-bearing media, and surplus-property routing through the state’s authorized disposal channel. Private-sector enterprises that contract with the state, that operate in regulated public-sector adjacent industries (higher education, K-12, state-funded healthcare), or that subcontract to state agencies inherit these duties through contract flow-down. See North Carolina Department of Information Technology policy guidance.

Data Destruction and Media Sanitization Expectations

G.S. 75-64 prescribes an outcome (cannot practicably be read or reconstructed) and remains method-agnostic. The operative method baseline is NIST Special Publication 800-88 Revision 2 (operative September 26, 2025), which categorizes media sanitization as Clear, Purge, and Destroy. North Carolina state agencies follow the N.C. Department of Information Technology (NCDIT) Statewide Information Security Manual, which references NIST 800-88. The audit-defensible position for a North Carolina enterprise is NIST 800-88 Rev. 2 alignment with method selection driven by media type, data sensitivity, and federal sector overlay.

Hard Drive Shredding

North Carolina-resident PII on fixed media requires the NIST 800-88 Rev. 2 Destroy outcome through physical shredding because N.C. Gen. Stat. § 75-64’s discard-without-destruction prohibition reaches unencrypted media in enterprise custody. Hard drive shredding reduces magnetic and solid-state media to particles small enough that data reconstruction is forensically impossible.

Certified Data Wiping

Certified data wiping aligned to NIST 800-88 Clear or Purge is appropriate where the asset is being remarketed or redeployed.

Media Degaussing

Media degaussing is the appropriate Purge method for legacy magnetic media. SSDs, NVMe, and modern flash media require cryptographic erase (Purge) or physical destruction (Destroy).

Certified Media Shredding

Certified media shredding covers non-drive media including optical disks, tape cartridges, USB drives, memory cards, smart cards, and any printed material containing personal information subject to G.S. 75-64.

North Carolina E-Waste, Hazardous Waste, and Environmental Compliance

North Carolina operates a manufacturer-takeback EPR program for computer equipment and televisions under G.S. 130A-309 Part 2H (Discarded Computer Equipment and Television Management). Computer equipment manufacturers register annually with NC DEQ under G.S. 130A-309.134 and pay initial registration fees of $10,000 (Level I), $10,000 (Level II), or $15,000 (Level III); subsequent annual fees are $15,000, $7,500, or $2,500. Television manufacturers register under G.S. 130A-309.135. Manufacturers must submit recycling plans for free, reasonably convenient recycling.

Enterprise / commercial equipment covered by the North Carolina e-waste program: PARTIAL. N.C. Gen. Stat. § 130A-309.130 et seq. (Discarded Computer Equipment and Television Recovery Act) operates under EPR for computers and televisions plus a landfill ban; enterprise bulk disposal of in-scope equipment must use registered recyclers, with other IT assets routing through 15A NCAC 13A hazardous-waste rules. North Carolina is an EPA-authorized state administering its own RCRA Subtitle C hazardous-waste program through 15A NCAC 13A; the state program operates at the federal floor unless explicitly more stringent.

G.S. 130A-309.86 prohibits disposal of computer equipment and televisions at solid waste management facilities (landfill ban effective July 1, 2011). NC DEQ Division of Waste Management Solid Waste Section enforces the landfill ban and the manufacturer-takeback program. Enterprise IT asset retirement in NC must route through manufacturer takeback programs, NC DEQ-authorized e-waste channels, or certified recyclers; landfill disposal is not lawful.

Hazardous-waste rules at 15A NCAC 13A (NC DEQ Division of Waste Management) implement federal RCRA as a delegated state program. Universal-waste rules at 15A NCAC 13A .0119 cover batteries, lamps, mercury-containing equipment, and mercury thermostats. Generator status follows the federal VSQG / SQG / LQG framework; cradle-to-grave generator liability applies. Civil penalties under G.S. 130A-22 run up to $10,000 per day per violation. Enterprise IT asset retirement routes through certified electronics recycling with environmental disposition records and, where applicable, hazardous-waste manifests.

Regulated Asset Types and Enterprise Scenarios

Servers and Storage Arrays

Server hardware and enterprise storage arrays contain operating-system data, application data, log files, configuration files with credentials, and database content. Certified server recycling covers the full asset including drive bays, controller cards, and embedded firmware storage. Every drive in the chassis must be sanitized to the Destroy category under NIST 800-88 Rev. 2 before custody transfer when biometric data, protected health information, financial-account information, or covered defense information was processed.

End-User Computing Assets

Certified laptop recycling and certified computer recycling route through the same chain-of-custody framework as server hardware. Note that “computer equipment” under G.S. 130A-309.131 includes desktops, laptops, tablets, monitors, peripherals (except keyboards and mice), and printers, all of which are landfill-banned.

Mobile Devices

Certified cell phone recycling includes verified erase of internal flash and handling of embedded SIM and eSIM material containing subscriber identifiers.

Equipment Destruction and Product-Recall Scenarios

Secure equipment destruction covers prototypes, defective products, and regulated equipment. Product recall management, defective product destruction, and classified equipment destruction cover specialized scenarios.

Enforcement, Penalties, and Audit Risk

North Carolina enforcement is concentrated at the NC Attorney General Consumer Protection Division (with private rights of action plus treble damages under G.S. 75-16), NC DEQ Division of Waste Management (e-waste and hazardous-waste violations), and federal regulators with concurrent jurisdiction. North Carolina has been an active multistate lead and participant in recent cyber actions: the NC AG led the multistate Equifax 2019 $600M settlement; multistate participation in TikTok 2024, Marriott 2024, Anthem 2020 $39.5M. The audit-reconstruction-of-events standard is operative.

Statutory Penalty Schedule

State Sectoral Regulators and Audit Authority

In addition to the North Carolina Attorney General and the North Carolina environmental agency, state-level sectoral regulators hold audit and inquiry authority over IT-asset-disposition-relevant controls within their regulated populations. The North Carolina Office of the Commissioner of Banks examines banks and credit unions for GLBA-aligned information-security-program controls. The North Carolina Department of Insurance examines insurance licensees for the written information security program required by the NAIC Insurance Data Security Act or state-equivalent. The North Carolina Department of Health and Human Services examines healthcare entities for HIPAA Security Rule compliance. The University of North Carolina System and N.C. Community College System oversees FERPA-overlapping records and student-data-privacy duties at state institutions of higher education. The North Carolina Utilities Commission examines investor-owned utilities for customer-data-protection controls. Each sectoral regulator can issue document requests, on-site examinations, or consent orders that probe the chain-of-custody, sanitization-certificate, and environmental-disposition records produced during IT asset retirement.

Documentation, Chain of Custody, and Audit-Ready Proof

North Carolina Attorney General Consumer Protection enforcement under N.C. Gen. Stat. § 75-1.1 (UDAP) is built from documentary evidence, and a Retired Electronic Asset without serialized destruction records is treated as a presumptive Identity Theft Protection Act disposal-duty failure. The G.S. 75-64(c) due-diligence and written-contract requirements depend on the documentation packet directly.

How All Green Recycling Operationalizes North Carolina Compliance

IT Asset Disposition

All Green Recycling operates certified IT asset disposition structured around North Carolina’s statutory duty surface, including the G.S. 130A-309.86 landfill ban and the G.S. 75-64 destruction outcome standard. Asset pickup is scheduled with a documented chain of custody, secured transport through IT equipment packaging and transportation, certified data destruction at the receiving facility, environmental disposition aligned to manufacturer takeback or DEQ-authorized channels, and audit-ready reporting. Asset remarketing recovers residual value while preserving chain of custody.

Secure Data Destruction

All Green Recycling’s secure data destruction service line is structured to satisfy the G.S. 75-64 “cannot practicably be read or reconstructed” outcome standard and align to NIST SP 800-88 Rev. 2.

Certified Electronics Recycling

Certified electronics recycling diverts retired electronic assets from landfill (mandatory under G.S. 130A-309.86) through NC DEQ-authorized channels that satisfy 15A NCAC 13A hazardous-waste characterization and 15A NCAC 13A .0119 universal-waste rules. R2v3, NAID AAA, and e-Stewards frameworks are used as reference frameworks for downstream-handler accountability.

Secure Equipment Destruction

Secure equipment destruction covers product-recall management, defective-product destruction, and classified-equipment destruction.

Reverse Logistics and Chain-of-Custody Tracking

Reverse logistics covers multi-site enterprise pickups, manufacturer return programs, and customer-driven returns.

Audit-Ready Reporting

Every engagement produces a uniform documentation package delivered through IT asset reporting: serialized asset list, chain-of-custody log, Certificate of Data Destruction, Certificate of Recycling, environmental disposition record (with landfill-ban compliance attestation), hazardous-waste manifest where applicable, and HIPAA / GLBA / FTC Safeguards documentation entries where the federal overlay applies.

Frequently Asked Questions

The questions below are the questions enterprise compliance, security, audit, and procurement leaders ask during vendor evaluations, RFP reviews, and breach-response planning when a Retired Electronic Asset is moving through IT Asset Disposition in North Carolina.

North Carolina Compliance as Risk Management

North Carolina IT asset retirement is a layered risk-management discipline, not a recycling transaction. Compliant retirement is the ability to prove, under scrutiny, that data was rendered unable to be practicably read or reconstructed before custody transfer, that biometric data and other broadly enumerated personal information were respected for the § 75-65 breach-trigger and § 75-64 destruction duty, that retired electronics did not enter solid waste management facilities (G.S. 130A-309.86 landfill ban), and that hazardous fractions were handled under the universal-waste rules. ITPA UDTPA carryover with treble damages, NC DEQ landfill-ban enforcement, NC DEQ hazardous-waste daily penalties, HIPAA federal overlay, FTC Safeguards Rule, and audit-driven counterparty review converge on the same set of records.

North Carolina compliance is best treated as a continuous control posture rather than a periodic disposal event. All Green Recycling, LLC operationalizes that posture through IT asset disposition, secure data destruction, certified electronics recycling, secure equipment destruction, reverse logistics, and audit-ready reporting. Compliance, security, and procurement teams that need a North Carolina-specific audit walkthrough or an RFP-ready compliance package reach the All Green Recycling response desk at (800) 780-0347.