1. Home
  2. State breach laws
  3. South Carolina

South Carolina data breach notification law

What South Carolina requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by S.C. Code Ann. § 39-1-90.

No fixed deadline
Notification deadline
Required
AG notification
Yes
Private right of action
None
Liability protection

What this means if you sell security services

South Carolina sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. A private right of action adds lawsuit exposure on top of regulatory cost, which makes incident-readiness, documented controls, and evidence-quality logging an easy conversation.

See recent South Carolina breach filings →

Requirements in detail

Statute
S.C. Code Ann. § 39-1-90
Deadline to notify residents
In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, allowing for law enforcement needs and time to determine the scope of the breach and restore the system. Notice may be delayed if law enforcement determines it would impede a criminal investigation.
Attorney General notification
Yes, but the notice goes to the Consumer Protection Division of the Department of Consumer Affairs, not the Attorney General. When more than 1,000 people are notified at one time, the business must notify that division and the nationwide consumer reporting agencies without unreasonable delay about the timing, distribution, and content of the notice.
Penalties
A business that knowingly and willfully violates the law faces an administrative fine of $1,000 for each resident whose information was accessible because of the breach, with the amount decided by the Department of Consumer Affairs.
Private right of action
Yes. Affected individuals can bring a private lawsuit under the breach notification law.
Encryption exemption
South Carolina's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. South Carolina has no law limiting breach lawsuits for organizations that maintain a security program.

South Carolina breach notification FAQ

What is the data breach notification deadline in South Carolina?

In the most expedient time possible and without unreasonable delay after discovering or being notified of the breach, allowing for law enforcement needs and time to determine the scope of the breach and restore the system. Notice may be delayed if law enforcement determines it would impede a criminal investigation. The governing law is S.C. Code Ann. § 39-1-90.

Does South Carolina require notifying the Attorney General of a data breach?

Yes, but the notice goes to the Consumer Protection Division of the Department of Consumer Affairs, not the Attorney General. When more than 1,000 people are notified at one time, the business must notify that division and the nationwide consumer reporting agencies without unreasonable delay about the timing, distribution, and content of the notice.

What are the penalties for failing to report a data breach in South Carolina?

A business that knowingly and willfully violates the law faces an administrative fine of $1,000 for each resident whose information was accessible because of the breach, with the amount decided by the Department of Consumer Affairs.

Can individuals sue over a data breach in South Carolina?

Yes. Affected individuals can bring a private lawsuit under the breach notification law.

Does encrypted data need to be reported in South Carolina?

South Carolina's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does South Carolina limit breach lawsuits for companies with a cybersecurity program?

No. South Carolina has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the South Carolina Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →