Skip to content
Network USA

SC · Breach notification statute

South Carolina data breach notification law

A summary of the South Carolina breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

S.C. Code Ann. § 39-1-90 (Trade and Commerce - Breach of Security; Notifications) (amended

Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

notify in the most expedient time possible and without unreasonable delay, with no specific numeric

Attorney general notice

Yes South Carolina requires notification to the Consumer Protection Division of the Department of

What counts as a breach

Not extracted in our PRC 2026 summary; check the statute.

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataNo
Medical informationNo
Government ID numbersNot extracted
Paper recordsYes
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in South Carolina

87 reports to HHS OCR affecting 2,631,488 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in South Carolina.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Spartanburg Regional Healthcare SystemHealthcare Provider400,000May 27, 2011TheftArchive (closed)
Stokes Regional Eye CentersHealthcare Provider266,170Jun 17, 2022Hacking/IT IncidentArchive (closed)
South Carolina Department of Health and Human ServicesHealth Plan228,435Apr 24, 2012Unauthorized Access/DisclosureArchive (closed)
Roper St. Francis HealthcareHealthcare Provider189,761Jan 8, 2021Hacking/IT IncidentArchive (closed)
Sandhills Medical FoundationHealthcare Provider169,017Sep 14, 2025Hacking/IT IncidentUnder investigation

Frequently asked questions

When must South Carolina businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the South Carolina timing rule as: "notify in the most expedient time possible and without unreasonable delay, with no specific numeric". (Source: PRC 2026 survey extract.)

Does South Carolina require notice to the attorney general?

The PRC 2026 extract notes: "Yes South Carolina requires notification to the Consumer Protection Division of the Department of". (Source: PRC 2026 survey extract.)

Does the South Carolina law cover biometric data?

No. The PRC 2026 survey does not record biometric data as covered by the South Carolina breach law.

Does the South Carolina law cover medical information?

No. The PRC 2026 survey does not record medical information as covered by the South Carolina breach law.

Does the South Carolina law cover paper records?

Yes. The PRC 2026 survey records paper (non-computerised) records as covered in South Carolina.

Is there a private right of action in South Carolina?

Yes. The PRC 2026 survey records a private right of action under the South Carolina breach law.

Is credit monitoring required in South Carolina?

No. The PRC 2026 survey does not record a credit monitoring requirement in South Carolina.

How does the South Carolina law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the South Carolina statute, and see our HIPAA vs state breach notification laws guide.

Sources