Data Breach Notice to Residents and State Authorities in South Carolina
At a glance
| Covered entity and service provider | SC business owner/licensee notifies residents; nonowner maintainer notifies owner/licensee immediately after discovery (§ 39-1-90(A)-(B)) |
|---|---|
| Breach and covered information | Unauthorized access AND acquisition of unprotected computerized data; name plus SSN, ID, financial access, or other unique government/financial identifiers (§ 39-1-90(A),(D)(1),(3)) |
| Risk screen or notice exception | Illegal use occurred or reasonably likely, OR use creates material resident harm risk; good-faith employee acquisition excluded (§ 39-1-90(A),(D)(1)) |
| Individuals who receive notice | SC residents whose unprotected PII was or is reasonably believed acquired without authorization when statutory misuse/harm test is met (§ 39-1-90(A)) |
| Individual notice deadline and clock | Most expedient time possible, without unreasonable delay after discovery/notification; no fixed outer day limit (§ 39-1-90(A)) |
| Regulator threshold and deadline | More than 1,000 persons notified at one time: SC Department of Consumer Affairs Consumer Protection Division, without unreasonable delay (§ 39-1-90(K)) |
| Consumer-reporting-agency notice | Same more-than-1,000-person trigger: all nationwide agencies without unreasonable delay; timing, distribution, content of notice (§ 39-1-90(K)) |
| Individual delivery and content | Written, qualifying electronic, or telephone notice; section does not prescribe an itemized resident letter (§ 39-1-90(A),(E)) |
| Substitute notice conditions and channels | Cost exceeds $250,000, class exceeds 500,000, or insufficient contacts: email if available OR website if maintained OR statewide media (§ 39-1-90(E)(4)) |
| Delays and alternate compliance | Police impediment delay until clearance; timing-consistent own-policy route; qualifying financial-institution exclusions (§ 39-1-90(C),(F),(I)-(J)) |
Requirements one by one
Trigger and risk test
S.C. Code § 39-1-90(A) addresses a business that owns or licenses computerized or other data with personal identifying information. Its definition of a security breach in subsection (D)(1), however, specifies unauthorized access to and acquisition of computerized data not rendered unusable through encryption, redaction, or other methods. The incident must involve illegal use that has occurred or is reasonably likely, or use creating a material risk of harm to a resident. Good-faith employee or agent acquisition for business purposes is excluded when the information is not used or further disclosed without authorization.
Subsection (D)(3) covers a resident's name linked to a Social Security or state ID number, financial-account access data, or other numbers that can access financial accounts or uniquely identify an individual when issued by government or a regulator. Lawfully public information is excluded.
People and agencies to notify
The owner or licensee tells affected South Carolina residents in the most expedient time possible and without unreasonable delay after discovery or notification. Section 39-1-90(A) gives no fixed outside day count. A nonowner business maintaining the data tells the owner or licensee immediately after discovery if unauthorized acquisition occurred or is reasonably believed to have occurred under subsection (B).
If the business gives notice to more than 1,000 persons at one time, subsection (K) adds notice without unreasonable delay to the Consumer Protection Division of the South Carolina Department of Consumer Affairs and all nationwide consumer reporting agencies. It reports the timing, distribution, and content of its notices.
Delivery choices
Section 39-1-90(E) permits writing, qualifying electronic notice, or telephone notice. If notice cost exceeds $250,000, the affected class exceeds 500,000, or contacts are insufficient, the business may use substitute notice. Unlike statutes that require all channels, subsection (E)(4) joins email where available, a website post if maintained, or major statewide media.
What trips people up
The regulator is Consumer Affairs. The more-than-1,000-person route in § 39-1-90(K) names the Department of Consumer Affairs' Consumer Protection Division, rather than a general Attorney General breach report.
Police clearance restarts notice. Under subsection (C), law enforcement may delay notice if it determines notice impedes a criminal investigation. Notice must be made after the agency determines it no longer compromises the investigation.
An internal procedure must respect the statutory timing. Under subsection (F), a business is deemed compliant if it follows its own information-security notice policy and that policy meets this section's timing requirements. Subsections (I)-(J) provide separate qualifying financial-institution routes.
Common questions
Is a risk-of-harm screen allowed?
Yes. Section 39-1-90(A) and (D)(1) make illegal use or material harm risk part of the notice and breach tests; they do not prescribe a separate written no-notice determination.
Does the law require a particular list of facts in the resident notice?
Section 39-1-90(A) requires disclosure of the qualifying breach, and subsection (E) lists delivery methods. The specific timing, distribution, and content report in subsection (K) goes to the division and nationwide agencies when its threshold is met.
Statutes and sources
- S.C. Code § 39-1-90 — current official Chapter 39-1 breach-notice text.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does South Carolina law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current South Carolina law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace