South Carolina healthcare breach data

Notification deadline

In the most expedient time possible and without unreasonable delay, following discovery or notification of the breach, subject to the statutory law-enforcement qualification and the statutory scope-of-breach / data-system-integrity qualification of § 39-1-90(A). No numeric outer bound.

State regulator notice

Required above 1,000 residents

When a business provides notice to more than 1,000 South Carolina persons at one time under § 39-1-90(A), the business must also notify the Consumer Protection Division of the South Carolina Department of Consumer Affairs, without unreasonable delay. This is the state-agency notice track — there is no direct Attorney General notification in § 39-1-90 itself.