South Carolina. Breach notification. Act
SC breach lawSouth Carolina data breach notification law (S.C. Code § 39-1-90)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about South Carolina residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account with codes, other numbers enabling financial access or unique government IDs.
- Key themes
- Unique features
Regulator is the Department of Consumer Affairs not the AG; per-resident administrative fines; private right of action.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: South Carolina requires the maintaining entity to notify the owner immediately following discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; Department of Consumer Affairs and CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- $1,000 per affected resident for knowing and wilful violations
§3Dates
- Key dates
- Adopted
- In force
- HB 3248 (2013) latest amendment
§4Text and authority
- Text
- Authoritative text scstatehouse.gov
- Authority
- South Carolina Department of Consumer Affairs
§5Where it applies
- Domestic law of
- South Carolina
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.