ShareAndGoShareAndGo

Data breach notification

South Carolina data breach notification law

In South Carolina the duty to disclose a breach of business data is in S.C. Code Ann. § 39-1-90.

It sets no day count. It asks for disclosure "in the most expedient time possible and without unreasonable delay."

Personal identifying information, as South Carolina defines it

The statute uses the phrase personal identifying information: "the first name or first initial and last name in combination with and linked to any one or more of the following data elements that relate to a resident of this State, when the data elements are neither encrypted nor redacted."

The elements are a Social Security number, a driver's license or state identification number, and an account or card number with any required code or password.

The list closes with a broad category: "other numbers or information which may be used to access a person's financial accounts or numbers or information issued by a governmental or regulatory entity that uniquely will identify an individual."

The text we checked notes that the section covers computerized and other data.

When disclosure is owed

Three conditions combine. The information was not rendered unusable "through encryption, redaction, or other methods"; it was, or is reasonably believed to have been, acquired by an unauthorized person; and "the illegal use of the information has occurred or is reasonably likely to occur or use of the information creates a material risk of harm to the resident."

That last condition works as a harm test. Where illegal use is neither occurring nor reasonably likely, and no material risk of harm arises, the duty does not attach.

The 1,000-person line

A business that "provides notice to more than one thousand persons at one time" must also notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs.

The nationwide consumer reporting agencies are told at that size as well.

Below that number, § 39-1-90 as read sets no regulator notice.

Where ShareAndGo fits

Firms in Columbia or Charleston that send account statements and ID copies to lenders or buyers often lose sight of who opened them.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarking is a per-room setting, on by default, so each viewed page carries the reader's email address.

Recipients confirm their email with a six-digit code, and groups see only their own folders. The chained activity log exports as CSV, which gives a working list of who looked at which file inside ShareAndGo.

Common South Carolina questions

Is there a 30 or 45 day limit?
Not in § 39-1-90 as read. The test is the most expedient time possible and without unreasonable delay.
Which agency gets told about a large breach?
The Consumer Protection Division of the Department of Consumer Affairs, when notice goes to more than 1,000 persons at one time.
Does redacted data count?
No. The definition reaches data elements that are neither encrypted nor redacted.

Checked

This page was read from Title 39, Chapter 1 of the South Carolina Code on the South Carolina Legislature's site.

Checked against South Carolina's published law on November 2, 2026. This is general information, not legal advice.

Next

Breach notification laws by state

Breach laws across the US.

ShareAndGo vs DataRooms.com

Data room comparison.

ShareAndGo home

ShareAndGo home.