North Dakota SaaS Agreement Review
North Dakota has no comprehensive consumer privacy statute, and its Century Code says relatively little about software contracts. For an agribusiness in Fargo or an energy services firm in the Bakken buying cloud tools, that puts the weight on the agreement itself and on one statute that does apply: Chapter 51-30, which governs notice of a security breach involving North Dakota residents' personal information.
Consumer privacy law in North Dakota
No comprehensive state privacy law yet
Data rights in North Dakota
As of October 2026, North Dakota has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What does Chapter 51-30 require after a breach?
N.D.C.C. 51-30-02 requires any person that owns or licenses computerized personal information to notify affected North Dakota residents in the most expedient time possible and without unreasonable delay. If a breach affects more than 250 individuals, the attorney general must also be told, by mail or email. Delay is allowed only for law enforcement needs or the measures needed to find the scope of the breach and restore the system.
The statute puts the duty on the data owner, which is usually you, not the SaaS vendor. Your contract should make the vendor report incidents to you quickly and in enough detail to judge whether the 250 person threshold is met.
Where North Dakota law is thin, what should the contract cover?
With no state privacy act, nothing requires a data processing agreement, so ask for one anyway. Spell out that your data is used only to provide the service, that it is not used to train the vendor's models, that it is deleted or returned at the end of the term, and that subcontractors are bound to the same terms. Check the liability cap too: a cap of one month's fees rarely covers the cost of notifying customers after a breach.
North Dakota also has no general automatic renewal statute aimed at business subscriptions, so the cancellation window in the contract controls.
North Dakota sources checked 2026-10-09: N.D.C.C. chapter 51-30. Laws change; confirm the current rule before relying on it.
North Dakota SaaS agreement FAQ
Does North Dakota have a data privacy law that affects SaaS contracts?
As of October 2026, North Dakota has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my North Dakota business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of North Dakota law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in North Dakota?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against North Dakota law in about a minute.
When must a North Dakota business notify the attorney general of a SaaS breach?
When the breach affects more than 250 individuals. N.D.C.C. 51-30-02 requires disclosure to the attorney general by mail or email in the most expedient time possible and without unreasonable delay. Because the business that owns the data carries that duty, require your vendor to report incidents and affected record counts promptly.
Does North Dakota restrict a vendor from using my data for its own products?
Not by statute. North Dakota has no comprehensive privacy law limiting secondary use, so the contract is the only control. Look for clauses letting the vendor use customer data to improve services or develop new features, and narrow them to aggregated, de-identified data or remove them.
Reviewing a SaaS contract in North Dakota?
Upload it and get the data, liability, and renewal terms checked against North Dakota law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current North Dakota law when you run your agreement, and you should confirm anything critical with a qualified attorney.