South Carolina Data Breach Notification Law

The South Carolina data breach notification law: Consumer Affairs and lawsuits

Two things make S.C. Code § 39-1-90 unusual. Large breaches are reported to the Department of Consumer Affairs instead of the Attorney General, and residents hold their own right to sue ¹.

The clock opens when the business finds the breach or is told of it, and runs on the most expedient time possible and without unreasonable delay ¹. An incident qualifies once illegal use of the data has happened or is reasonably likely, or that use creates a material risk of harm to a resident ¹. South Carolina does not require you to write up a decision not to notify, though with private suits allowed, a memo is wise.

Beyond name plus Social Security, license or card numbers, the law protects any other number or information that opens a person's financial accounts, and any identifier a government or regulatory body issues to one person ¹.

Notifying Consumer Affairs and the credit bureaus

The trigger is more than 1,000 persons notified at one time. At that point the Consumer Protection Division and every nationwide credit bureau must be told, without unreasonable delay, how and when the letters went and what they said ¹. Note the word persons: the count includes everyone who gets a letter, not just South Carolinians.

Own-policy compliance is available to a business whose written notice policy keeps the same timing, and GLBA banks and financial institutions are outside the statute ¹. Insurance companies have a separate law, the South Carolina Insurance Data Security Act ¹. Storage and processing vendors must tell the data owner immediately after they discover a breach ¹.

Fines per resident and private lawsuits

South Carolina's penalties come from two directions, and the state fine scales with headcount:

• Administrative fine. A knowing and willful violation brings a fine of $1,000 for each resident whose information was accessible, set by the Department of Consumer Affairs ¹. At that rate, a knowing and willful failure involving 2,000 residents' records would mean a $2 million fine.
• Lawsuits. An injured resident may sue for damages for a willful and knowing violation, actual damages for a negligent one, and an injunction, with attorney's fees if successful ¹.

Records made unusable by encryption, redaction or a similar method are exempt ¹. A stolen key goes unmentioned in the statute, which is a good reason to store keys and admin credentials apart from the data. Key storage and the rest of the insurer checklist are covered in security controls for small companies.

Working through a South Carolina breach

While the breach is active, a covered business rings its carrier before anyone else, reports the incident at ic3.gov so the FBI has it on file, and freezes the affected systems in place for the forensic team ²⁴³.

1. Have a containment and forensics firm, or your current IT company, on the problem the same day.
2. If the policy names panel counsel, use that firm; typical cyber policy conditions explains why carriers insist.
3. Total every letter you will send, wherever the recipient lives, since the 1,000 line counts persons. Then group by state: North Carolina and Georgia residents bring their own rules, and the all-state breach comparison covers the others.
4. Past 1,000, file with Consumer Affairs and the bureaus.

A clinic or other HIPAA covered business must also meet the federal health data breach rule. For local IT pricing, see our Charleston and Greenville pages.

Section 39-1-90 was set against this summary on October 13, 2026. We provide information, not legal advice, and since residents can sue here, a South Carolina lawyer should review any choice not to send letters.