# South Carolina — US state data breach notification deadlines by state

For South Carolina, statute citation is S.C. Code Ann. § 39-1-90; individual notice deadline is in the most expedient time possible and without unreasonable delay; ag notice resident-count trigger is more than one thousand persons; consumer reporting agency notice trigger (residents) is more than one thousand persons; encryption safe harbor is yes, recorded from its source on 2026-08-18.

- **State:** South Carolina _(verified: appears in the quote below)_
- **Statute citation:** S.C. Code Ann. § 39-1-90
- **Individual notice deadline:** in the most expedient time possible and without unreasonable delay _(verified: appears in the quote below)_
- **AG notice resident-count trigger:** more than one thousand persons _(verified: appears in the quote below)_
- **Consumer reporting agency notice trigger (residents):** more than one thousand persons _(verified: appears in the quote below)_
- **Encryption safe harbor:** yes _(our reading, not quoted from the source)_
- **Notes:** The AG notice goes to the Consumer Protection Division of the Department of Consumer Affairs, not directly the Attorney General. AG and CRA thresholds are the same (1,000 persons). Banks and financial institutions compliant with Gramm-Leach-Bliley Act or the federal Interagency Guidance are explicitly exempt (subsections I and J). _(our reading, not quoted from the source)_

## What the source says

> (K) If a business provides notice to more than one thousand persons at one time pursuant to this section, the business shall notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs and all consumer reporting agencies that compile and maintain files on a nationwide basis, as defined in 15 U.S.C. Section 1681a(p), of the timing, distribution, and content of the notice. HISTORY: 2008 Act No. 190, SECTION 7.A, eff July 1, 2009; 2013 Act No. 15, SECTION 3, eff April 23, 2013. Effect of Amendment The 2013 amendment rewrote subsection (D)(3), the definition of "Personal identifying information". South Carolina

## Source

- https://www.scstatehouse.gov/code/t39c001.php

Last verified: 2026-08-18. Review by: 2027-02-14.
Part of [US state data breach notification deadlines by state](https://referencesource.org/data-breach-notification-clocks/).