United States law applies in South CarolinaSouth Carolina is a state of the United States, whose 134 researched instruments are listed on the United States page, not here. The law of South Carolina, described on this page below, applies here too.
12 of 19 named instruments researched to a stage, across five of the ten areas of law we track: 12 in force. As of .
When each starts12 of 12 carry a date. Earlier is before 2014.
in forcenot yet in forceblocked by a courtproposedno longer in force
South Carolina has not enacted a general-purpose AI-transparency, output-labeling, or risk-management statute; the state's enacted AI-specific provisions criminalize conduct rather than mandate disclosure.
2025 Act No. 58 (S.29), effective , extended South Carolina's first, second, and third degree sexual exploitation of a minor offenses (Sections 16-15-395, 16-15-405, 16-15-410) to a 'morphed image of an identifiable minor,' a definition broad enough to reach a computer-generated or AI-altered depiction, so that producing, distributing, or possessing such a depiction of an identifiable minor is punished the same as a real photograph.
Several AI-specific consumer-protection and chatbot bills remained pending as of the date shown, none having been enacted: S. 896 (Chatbot Protection Act, with companion H. 5138) received a favorable committee report with amendment from the Senate Labor, Commerce and Industry Committee on but has not been voted on by either full chamber; S. 788 (AI therapy and psychotherapy disclosure) passed the Senate 44 to 0 on , was read the third time and sent to the House on , and is referred to the House Committee on Medical, Military, Public and Municipal Affairs; S. 963 (Consumer Protections in Interactions with Artificial Intelligence Systems Act), S. 1037 (Protecting Children from Chatbots Act), S. 443 (physician oversight of AI-informed health-insurance coverage decisions), and H. 3517 (deceptive deepfake media in elections) each remain in their first committee of referral.
South Carolina's general Unfair Trade Practices Act (S.C. Code Ann. §§ 39-5-10 to 39-5-160) is available in principle as a backstop against a deceptive bot or AI-generated content used to defraud consumers, but has not been tested against an AI-specific fact pattern, and several of the pending bills would expressly designate a violation of their own AI-specific duties as an unfair trade practice actionable under it.
2025 Act No. 58 (S.29), effective , added a definition of 'morphed image' at Section 16-15-375(8), covering any visual depiction, including a computer or computer-generated image, that has been created, adapted, or modified to appear that an identifiable minor is engaged in sexual conduct or sexually explicit nudity.
The same act inserted that term into South Carolina's first, second, and third degree sexual exploitation of a minor offenses (Sections 16-15-395, 16-15-405, 16-15-410), so that producing, distributing, or possessing a morphed depiction of an identifiable minor is punished the same as a real photograph of that minor.
The act also added Section 16-15-412, restricting an arrest warrant for a morphed-image offense to one issued on a state grand jury true bill or a probable-cause finding from an Internet Crimes Against Children Task Force investigation conducted with the Attorney General's Office.
South Carolina has no enacted general controller or processor personal-data statute, and no comprehensive bill has even passed a chamber. It does have an enacted minors-focused design-code statute, the South Carolina Age-Appropriate Design Code, enacted as Act No. 96 of 2026 (H. 3431), codified as new Chapter 80 of Title 39, S.C. Code Ann. secs. 39-80-10 et seq., signed and effective .
A different, unrelated bill, H. 3402, carries the same short title but would have created Chapter 79 and never advanced past committee referral; the citation here is drawn from the enacted H. 3431 text itself, not from either bill number alone.
Chapter 80 lists biometric data among sensitive personal data requiring heightened, minor-protective design duties, but never defines the term anywhere in the chapter, so whether it excludes an identifier derived from a photograph, video, or audio recording cannot be determined from the text; a narrower, separate clause excludes only a minor's biometric data collected without the minor's knowledge from the chapter's definition of publicly available data.
Chapter 80's own enforcement section names only the Attorney General and imposes treble damages, but does not say whether that remedy is available to a private plaintiff; the text leaves the question open. South Carolina's breach-notification statute, S.C. Code Ann. sec. 39-1-90, in force since , carries an express, direct private right of action for an injured resident, unusual, which typically finds a private route only by an indirect deeming-plus-UDAP chain or not at all.
South Carolina's state-agency breach-notification statute, section 1-11-490 of its Code, binds an agency of the State or of a political subdivision of it.
S.C. Code Ann. sec. 39-1-90official South Carolina statute text, S.C. Code Ann. sec. 39-1-90, consolidated South Carolina Code of Laws
In force since .Binds private bodies.
What this law does
A person conducting business in South Carolina that owns or licenses computerized data including personal identifying information must disclose a breach of the security of the system to an affected South Carolina resident in the most expedient time possible and without unreasonable delay, where the breach creates a material risk of harm.
Personal identifying information is name plus a Social Security number, driver's license or state ID number, a financial account number with access credential, or another government-issued identifying number; biometric, genetic, or health data is not folded into this definition. If a business notifies more than 1,000 persons at one time, it must also notify the Consumer Protection Division of the Department of Consumer Affairs and nationwide consumer reporting agencies.
The current definition of personal identifying information took effect ; the notification duty itself took effect . A resident injured by a violation may bring a civil action for damages (willful and knowing violations) or actual damages (negligent violations), seek an injunction, and recover attorney's fees, an express, direct private right of action rather than one reached indirectly through a deeming clause.
An administrative fine of $1,000 per affected resident is also available to the Department of Consumer Affairs for a knowing and willful violation.
S.C. Code Ann. sec. 1-11-490official South Carolina statute text, S.C. Code Ann. sec. 1-11-490, consolidated South Carolina Code of Laws
In force since .Binds government bodies.
What this law does
An agency of this State that owns or licenses computerized data or other data that includes personal identifying information must disclose a breach of the security of the system, following discovery or notification of the breach, to a resident of this State whose unencrypted and unredacted personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person.
The disclosure must be made in the most expedient time possible and without unreasonable delay, consistent with the legitimate needs of law enforcement or with measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system.
An agency that maintains such data it does not own must notify the owner or licensee of the information of a breach immediately following discovery, if the personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person. An agency means any agency, department, board, commission, committee, or institution of higher learning of the State or a political subdivision of it.
Personal identifying information has the same meaning as in section 16-13-510(D) of the South Carolina Code. If an agency gives notice to more than one thousand persons at one time, it must also notify, without unreasonable delay, the Consumer Protection Division of the Department of Consumer Affairs and every nationwide consumer reporting agency of the timing, distribution, and content of the notice.
A resident of this State who is injured by a violation may institute a civil action to recover damages, seek an injunction to enforce compliance, and recover attorney's fees and court costs if successful. An agency that knowingly and wilfully violates the section is subject to an administrative fine of up to one thousand dollars for each resident whose information was accessible by reason of the breach, the amount to be decided by the Department of Consumer Affairs.
The Age-Appropriate Design Code applies to a covered online service reasonably likely to be accessed by a minor (a person under 18). It is not a general controller or processor personal-data regime; it imposes design and data-minimization duties specifically toward minor users, including default privacy settings, limits on profiling, targeted advertising, and precise-geolocation collection for known minors, parental controls, and an annual public report by an independent auditor.
The Act was enacted as Act No. 96 of 2026 (H. 3431, the South Carolina Social Media Regulation Act on its own caption) and creates Chapter 80 of Title 39; it took effect immediately upon the Governor's approval on . It is not to be confused with H. 3402, a different, still-pending bill sharing the short title 'Age-Appropriate Design,' which would have created Chapter 79 and never advanced past referral to House Judiciary.
The Attorney General enforces Chapter 80. A covered online service is liable for treble the financial damages incurred as a result of a violation, and officers and employees of a covered online service may be held personally liable for willful and wanton violations.
The 30,353-character enacted text does not resolve whether the treble-damages remedy is available to a private plaintiff or is confined to a suit the Attorney General brings: no clause reads that an injured person may bring a civil action, the phrasing South Carolina's breach statute uses to grant one, and no clause reads that the chapter creates no private right of action, the phrasing Pennsylvania's and West Virginia's comparable proposed and dead bills use to foreclose one.
Whether a private right of action exists is therefore not established for this instrument; the treble-damages and personal-liability clauses read most naturally as remedies within the Attorney General's own suit given the enforcement section's framing naming only the Attorney General, and no construing case settles it.
Chapter 80 defines sensitive personal data to include a Social Security number, precise geolocation, racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, union membership, the contents of an individual's mail, email, or text messages, genetic data, biometric data for the purpose of uniquely identifying an individual, and health data.
'Biometric data' itself is never defined anywhere in the 30,353-character enacted text; the term appears exactly twice, once in this sensitive-data list and once in the publicly-available-data carve-out below, with no accompanying definitional entry among the chapter's twenty defined terms.
Whether the term excludes an identifier derived from a photograph, video, or audio recording therefore cannot be determined from the statutory text; there is no definitional clause to read as imposing or narrowing such an exclusion.
A narrower, separate carve-out excludes only 'biometric data collected by a covered online service about a minor without the minor's knowledge' from the chapter's definition of publicly available data, which does not address an adult's biometric data, or a knowingly collected minor's, drawn from a public recording.
South Carolina's Computer Crime Act (S.C. Code Ann. §§ 16-16-10 to 16-16-40) adds a state felony and misdemeanor computer-trespass regime graded by the dollar amount of gain or loss, rather than the federal baseline's bare without-authorization test alone: a first-degree felony requires gain or loss exceeding ten thousand dollars, while a separate misdemeanor offense, computer hacking, reaches unauthorized access, port scanning, or exceeding a granted permission regardless of any financial harm.
The chapter's own civil remedy, Section 16-16-25, arms the owner or lessee of an affected computer system with a private action for compensatory damages, restitution, and attorney's fees, but only against a person already convicted under the chapter, a narrower private right than an independent civil cause of action.
South Carolina has not enacted a comprehensive consumer privacy statute, so no state privacy-regime restriction on scraped public personal data exists beyond the federal baseline; no South Carolina case law addressing robots.txt's legal weight, browsewrap or clickwrap enforceability, or trespass to chattels in a scraping-specific dispute was found.
South Carolina's Unfair Trade Practices Act (S.C. Code Ann. §§ 39-5-10 to 39-5-160), a general consumer-protection statute carrying a private right of action and Attorney General civil penalties of up to five thousand dollars per violation, is available in principle against a deceptive scraping-adjacent practice but is untested against scraping specifically. Copyright, text-and-data-mining, and database rights are federal only; South Carolina adds nothing there.
Sections 16-16-10 through 16-16-40 make it unlawful to wilfully, knowingly, and maliciously access a computer, computer system, or computer network without authorization or for an unauthorized purpose to devise a scheme to defraud, obtain money or property by fraud, commit another crime, or to alter, damage, destroy, or modify data, programs, software, or operation, or introduce a computer contaminant; a separate misdemeanor, computer hacking, reaches unauthorized access, port scanning, or exceeding a granted permission regardless of financial gain or loss.
The offense is graded in three degrees by the dollar amount of gain or loss, from a felony (first degree, gain or loss exceeding ten thousand dollars) down to a misdemeanor (third degree, gain or loss of one thousand dollars or less, or computer hacking alone), and each computer, system, or network affected by a violation is a separate offense.
The owner or lessee of an affected computer system may also bring a civil action for compensatory damages, restitution, and attorney's fees, but only against a person already convicted under this chapter.
Beyond the records-disposal duty of section 37-20-190, filed as a row of its own, South Carolina has no general reasonable-security or information-security-program statute of broad private-sector application comparable to New York's SHIELD Act or Massachusetts's 201 CMR 17.00, no statute setting security requirements a software product or connected device must meet to be placed on the market, comparable to California's or Oregon's connected-device statutes, no coordinated-vulnerability-disclosure statute, and no litigation safe-harbor tied to a named cybersecurity framework.
The State's only enacted security-specific statute is the South Carolina Insurance Data Security Act, S.C. Code Ann. secs. 38-99-10 through 38-99-100, added by 2018 Act No. 171 (H.4655), Section 3, effective , with licensees given until to implement Section 38-99-20 generally and until to implement its third-party-service-provider due-diligence duty at Section 38-99-20(F).
The Act requires a 'licensee', defined at Section 38-99-10(9) as a person licensed, authorized to operate, or registered, or required to be licensed, authorized or registered, under the insurance laws of the State (excluding a purchasing group, an out-of-state-chartered risk retention group, or an out-of-state-domiciled assuming insurer), to develop, implement and maintain a written information security program commensurate with its size, complexity and the sensitivity of the nonpublic information in its possession (Section 38-99-20(A)), to designate a person responsible for it, conduct a risk assessment and implement enumerated safeguards including access controls, encryption of nonpublic information in transit and on portable media, multifactor authentication and secure-disposal procedures (Section 38-99-20(D)), to exercise due diligence over third-party service providers (Section 38-99-20(F)), to maintain a written incident response plan (Section 38-99-20(H)), and to investigate a cybersecurity event and notify the Department of Insurance's Director within seventy-two hours where South Carolina is the licensee's state of domicile or home state, or where at least two hundred and fifty affected State residents and either a governmental-notice trigger or a material-harm likelihood are present (Section 38-99-40(A)).
A licensee with fewer than ten employees, an employee or agent of a licensee already covered by that licensee's program, and a Health Insurance Portability and Accountability Act (HIPAA)-covered licensee that certifies its HIPAA program's compliance are exempted from Section 38-99-20 (Section 38-99-70).
The Director enforces through the examination and investigation powers of Section 38-13-10 et seq. and may take necessary and appropriate action against a violation (Section 38-99-50); a violation is subject to the penalties of Section 38-2-10 (Section 38-99-80), and the Act's own enacting language states it may not be construed to create or imply a private cause of action.
Its program and notice duties are filed as rows of their own, flagged for an insurer: a developer whose app is not itself an insurance licensee falls outside the Act's scope regardless of which activities it declares.
South Carolina's breach-notification statute, S.C. Code Ann. sec. 39-1-90 (Business data, breach of security; notifications, definitions, penalties, and exceptions), imposes only a post-breach disclosure duty on a person conducting business in the State who owns, licenses or maintains computerized personal identifying information (subsections (A) and (B)); its subsection (F) lets a business substitute its own information-security-policy notification procedure for the statute's default notice mechanics where one already exists, but does not itself require a business to adopt an information security program, so the section carries no affirmative safeguards duty of its own and stays entirely the jurisdiction's privacy-topic row rather than a security instrument here.
No enacted South Carolina statute sets product-security or connected-device requirements, a coordinated-vulnerability-disclosure duty, a critical-infrastructure or sector cyber-resilience regime naming a digital service, or a state-agency IT security policy extended to reach a private vendor.
Three bills pending in the 2025-2026 session as of touch adjacent ground without reaching it: Bill 4393 (South Carolina Technology Security Act) and Bill 4973 (Critical Infrastructure) are foreign-adversary procurement and equipment-ban measures rather than product-security or incident-reporting duties, and Bill 3375 (Electronic Device Security) reaches only the electronic devices of state agencies, higher-education institutions, and political subdivisions including school districts, so none would be filed here even if enacted, and none had been enacted by that date.
South Carolina's Insurance Data Security Act requires each licensee to develop, implement, and maintain a comprehensive written information security program. The same Act requires a licensee to notify the director no later than seventy-two hours after determining that a cybersecurity event has occurred, in the cases it lists. When a business disposes of a business record that contains personal identifying information of a customer, it must make that information unreadable or undecipherable.
Each licensee must develop, implement, and maintain a comprehensive written information security program based on its risk assessment that contains administrative, technical, and physical safeguards for nonpublic information and the licensee's information system.
A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of South Carolina, other than a purchasing group, a risk retention group chartered and licensed in another state, or a licensee acting as an assuming insurer domiciled in another state or jurisdiction.
Based on its risk assessment, a licensee must determine the appropriateness of, and implement, protection by encryption or other appropriate means of all nonpublic information transmitted over an external network and all nonpublic information stored on a laptop computer or other portable computing or storage device or media. A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event.
A licensee must exercise due diligence in selecting its third-party service provider and require the provider to implement appropriate administrative, technical, and physical measures to protect the information systems and nonpublic information it holds or can access.
If the licensee has a board of directors, the board or an appropriate committee must require executive management to develop, implement, and maintain the program and to report in writing at least annually on its status and compliance. Each insurer domiciled in South Carolina must submit to the director by February fifteenth a written statement certifying that it is in compliance with the section.
Licensees have until to implement the section generally and until to implement the third-party service provider duty. A licensee with fewer than ten employees, including any independent contractors, is exempt from the section. The director may examine and investigate the affairs of a licensee and take necessary and appropriate action to enforce the chapter. The Act may not be construed to create or imply a private cause of action for a violation of its provisions.
When a business disposes of a business record that contains personal identifying information of a customer, the business must modify the information, by shredding, erasing, or other means, to make it unreadable or undecipherable. A business complies if it contracts with a person engaged in the business of disposing of records for the modification of personal identifying information on its behalf.
The section does not apply to a bank or financial institution subject to and in compliance with the Gramm-Leach-Bliley Act privacy and security provisions, a health insurer subject to and in compliance with the federal health privacy and security standards, or a consumer credit-reporting agency subject to and in compliance with the Fair Credit Reporting Act.
A consumer credit-reporting agency or other person that wilfully violates a provision of the chapter is liable for three times the amount of actual damages or not more than one thousand dollars for each incident, whichever is greater, as well as reasonable attorney's fees and costs. A consumer credit-reporting agency or other person that negligently violates the chapter is liable for actual damages and reasonable attorney's fees and costs. The section has applied since .
A licensee must notify the director no later than seventy-two hours after determining that a cybersecurity event has occurred when South Carolina is its state of domicile in the case of an insurer, or its home state in the case of a producer.
The licensee must give the same notice when it reasonably believes the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of its normal operations.
The licensee must provide as much as possible of 13 listed items of information, in electronic form as the director directs, and has a continuing obligation to update and supplement its notifications. A licensee must provide the director a copy of the notice sent to consumers when it is required to notify the director. A licensee must treat a cybersecurity event in a system maintained by a third-party service provider as it would an event under the notice subsection.
An assuming insurer that does not have a direct contractual relationship with the affected consumers must notify its affected ceding insurers and the director of its state of domicile within seventy-two hours of making the determination that a cybersecurity event has occurred. A licensee that learns a cybersecurity event has occurred or may have occurred must conduct a prompt investigation.
The licensee must maintain records concerning all cybersecurity events for a period of at least five years from the date of the event and produce those records upon demand of the director. A licensee that violates a provision of the chapter is subject to the penalties provided in section 38-2-10.
South Carolina has required age verification for adult content sites since January 2025, and enacted an Age-Appropriate Design Code Act in February 2026 that took immediate effect. NetChoice sued over the design code within days of enactment, and a preliminary injunction motion is pending. South Carolina has not enacted a social-media-specific age verification law or an app store accountability law; an App Store Accountability Act bill (H.3405) has not advanced out of the House.
Requires a commercial entity that knowingly publishes material on a website, more than one third of which is material harmful to minors, to perform reasonable age verification of South Carolina visitors using a digitized identification card, a third party verification service, or a commercially reasonable method relying on transactional data.
Requires online services reasonably likely to be accessed by minors to set protective default privacy settings for known minors, offer opt outs from personalized recommendation systems, limit addictive design features and nighttime and school hours notifications, and undergo independent third party audits reported to the Attorney General. NetChoice sued days after enactment and a preliminary injunction motion is pending.
These areas of law were researched here and no instrument was recorded. Each finding says what the research checked, as of the date under it. It describes our search, not a guarantee that no such law exists.
Reuse law
South Carolina has no enacted statute creating a press-publisher neighbouring right, a mandatory platform-to-publisher bargaining code, or any other news-aggregation-specific regime.
Title 39 (Trade and Commerce) was checked for a bargaining or licensing scheme comparable to Australia's News Media Bargaining Code, Canada's Online News Act, or California's failed AB 886, and none exists; South Carolina's general Unfair Trade Practices Act (S.C. Code Ann. §§ 39-5-10 to 39-5-160) is a general consumer-protection statute with no provision addressing snippet reproduction, framing, or a publisher's payment right.
Title 16 (Crimes and Offenses) was checked for a misappropriation or hot-news offense and carries none; South Carolina's common-law unfair-competition and misappropriation doctrine has not been reported applied to a news-aggregation fact pattern in a published South Carolina appellate decision. The 126th General Assembly's 2025-2026 session carries no South Carolina bill comparable to a press-publisher right or a bargaining code.
Snippet reproduction, text-and-data-mining, and hyperlinking or framing are governed by federal copyright law only; South Carolina adds nothing there.
As of .
Case law
No current case law for South Carolina AI law
No current case law for South Carolina privacy law
No current case law for South Carolina scraping law
No current case law for South Carolina cybersecurity law
No current case law for South Carolina communications law
No current case law for South Carolina content moderation law
No current case law for South Carolina product and AI liability law
No current case law for South Carolina digital accessibility law
No current case law for South Carolina age gating law
No current case law for South Carolina reuse law
Reporting clocks that run here19 instruments
The instruments whose obligation lines set a deadline for reporting an incident, a vulnerability or a personal-data breach, each deadline read from the sentence that carries it and listed shortest first. The law of South Carolina comes first, then the law of the bodies above it that applies here.
Each flag is one law, and a link to it. Read down the scale: the clocks document's time axis, with the empty stretches shortened so the deadlines sit close. Flags on one line set the same duty at the same deadline, and the laws behind them are named to the right, with what each clock counts from.
The deadlines above on one time axis, shortest at the top. The axis keeps its order and, between neighbors, its proportion, but a stretch with no deadline on it is shortened, so the hour marks on the left are what say how far apart two stations really are. Beside each action, the laws that set it, what each counts from, and a status where the law is not yet in force. The List tab has the same data in full, with the sentences.
Notify the director of the Department of Insurance no later than seventy-two hours after you determine that a cybersecurity event has occurred, when South Carolina is your state of domicile (insurer) or your home state (producer).
Give the same notice within seventy-two hours when you reasonably believe the nonpublic information involved is of no less than two hundred and fifty consumers residing in South Carolina and the event requires notice to a governmental body, self-regulatory agency or other supervisory body under state or federal law, or has a reasonable likelihood of materially harming a consumer residing in South Carolina or a material part of your normal operations.
As an assuming insurer that does not have a direct contractual relationship with the affected consumers, notify your affected ceding insurers and the director of your state of domicile within seventy-two hours of determining that a cybersecurity event has occurred; as an insurer whose consumers accessed your services through an independent producer, notify the producers of record of affected consumers as soon as practicable as the director directs.
Notify each affected South Carolina resident of a breach of security involving personal identifying information in the most expedient time possible and without unreasonable delay.
Disclose a breach of the security of the system to each South Carolina resident whose unencrypted and unredacted personal identifying information was, or is reasonably believed to have been, acquired by an unauthorized person, in the most expedient time possible and without unreasonable delay (section 1-11-490(A)).
If you maintain such data you do not own, notify the owner or licensee of the information of a breach immediately following discovery (section 1-11-490(B)).
If you give notice to more than one thousand persons at one time, notify the Consumer Protection Division of the Department of Consumer Affairs and every nationwide consumer reporting agency, without unreasonable delay, of the timing, distribution and content of the notice (section 1-11-490(I)).
The law of the United States, which applies in South Carolina
Notify the NRC Headquarters Operations Center via the Emergency Notification System within one hour after discovery of a cyberattack that adversely impacted safety-related or important-to-safety functions, security functions, or emergency preparedness functions (including offsite communications), or that compromised support systems and equipment resulting in adverse impacts to those functions.
Also notify within one hour after discovery of a cyberattack that adversely impacted the safety, security, and emergency preparedness functions performed by digital assets described in 10 CFR 73.77(a)(1)(ii).
Notify the NRC Headquarters Operations Center within four hours after discovery of a cyberattack that could have caused such an adverse impact, after discovery of a suspected or actual cyberattack initiated by personnel with physical or electronic access to the systems in scope, or after notifying a local, State, or other Federal agency of an event related to your cyber security program that does not otherwise require notification.
Notify the NRC Headquarters Operations Center within eight hours after receipt or collection of information regarding observed behavior, activities, or statements that may indicate intelligence gathering or pre-operational planning related to a cyberattack against the systems in scope.
Use the site corrective action program to record vulnerabilities, weaknesses, failures and deficiencies in your cyber security program, and the notifications you make, within twenty-four hours of their discovery.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.
Upon any responsible SCI personnel having a reasonable basis to conclude that an SCI event has occurred, begin appropriate corrective action and notify the Commission of the SCI event immediately.
Within 24 hours of that conclusion, submit a written notification to the Commission, made on a good faith, best efforts basis, that describes the SCI event and the systems affected and, to the extent available, your assessment of the market participants potentially affected, the potential impact on the market, and the steps you have taken, are taking or plan to take.
If the SCI event is resolved and the investigation closed within 30 calendar days, submit a final written notification within five business days after resolution. If not, submit an interim written notification within 30 calendar days after the event, and a final one within five business days after resolution and closure.
If your organization is a banking organization, notify your primary federal banking regulator, the OCC, the Federal Reserve Board, or the FDIC, whichever supervises it, about a notification incident, as soon as possible and no later than 36 hours after your organization determines that a notification incident has occurred.
A notification incident is the subset of computer-security incidents that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, your ability to serve customers, a business line, or an operation whose failure would threaten the financial stability of the United States, so a computer-security incident that falls short of that threshold does not by itself start this clock.
If your organization is a bank service provider, notify at least one bank-designated point of contact at each affected banking organization customer as soon as possible after your organization determines that it has experienced a computer-security incident that has materially disrupted or degraded, or is reasonably likely to materially disrupt or degrade, covered services provided to that banking organization for a period of four hours or more.
This duty carries a standard, as soon as possible, rather than a fixed number of hours to notify by, and that disruption threshold is what engages the duty rather than a period to notify within.
If you are a developer or provider of a frontier AI model, or an operator of critical infrastructure that uses an AI model to manage industrial control systems or other operational technologies, report any confirmed AI safety incident or AI security incident within 30 days of confirmation, and within 72 hours if the incident poses an imminent threat to national security, critical infrastructure or public safety.
If your organization is a federally insured credit union, notify the NCUA-designated point of contact of a reportable cyber incident by email, telephone, or another method the NCUA prescribes, so that the NCUA receives the notification as soon as possible and no later than 72 hours after your organization reasonably believes it has experienced a reportable cyber incident.
Where the reportable cyber incident is a disruption of business operations or unauthorized access to sensitive data facilitated through, or caused by, a compromise of a credit union service organization, cloud service provider, or other third-party data hosting provider, or by a supply chain compromise, the NCUA must receive the notification within 72 hours of your organization being notified by the third party if that is sooner.
Send the notice as soon as practicable, but not later than 30 days, after becoming aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred, delaying it only for the period the United States Attorney General specifies where the Attorney General determines that notice poses a substantial risk to national security or public safety (17 CFR 248.30(a)(4)(iii)).
Maintain written policies and procedures reasonably designed to require oversight, including through due diligence and monitoring, of service providers, including that a service provider notify you as soon as possible, and no later than 72 hours, after becoming aware of a breach in security resulting in unauthorized access to a customer information system it maintains (17 CFR 248.30(a)(5)(i)).
Rapidly report a cyber incident to the Department of Defense within 72 hours of discovering it, at the Department's DIBNet portal (dibnet.dod.mil), using a DoD-approved medium assurance certificate that you must obtain before you need to file a report.
Make those policies and procedures reasonably designed to ensure that each service provider takes appropriate measures to protect against unauthorized access to or use of customer information, and to notify you as soon as possible, but no later than 72 hours after becoming aware that a breach in security has occurred resulting in unauthorized access to a customer information system the service provider maintains.
If your organization is an Securities and Exchange Commission (SEC) reporting company, determine, without unreasonable delay after you discover a cybersecurity incident, whether the incident is material, and if it is, file a Form 8-K under Item 1.05 within four business days after you make that determination.
If the information called for in Item 1.05 is not determined or is unavailable when you file, state that in the filing and file an amendment to the Form 8-K within four business days after you determine it or it becomes available.
After you reasonably determine that a breach of your customers' CPNI has occurred, electronically notify the United States Secret Service and the Federal Bureau of Investigation through the central reporting facility as soon as practicable, and in no event later than seven business days (47 CFR 64.2011(b)).
Do not notify customers or disclose the breach where the relevant investigating agency directs you in writing not to, for an initial period of up to 30 days that the agency may extend (47 CFR 64.2011(b)(3)).
If you are a vendor of personal health records (an entity that offers or maintains an electronic record of health information that can draw information from multiple sources and is managed, shared and controlled by or primarily for the individual) or a PHR related entity, notify each affected individual who is a citizen or resident of the United States, in plain language and without unreasonable delay, no later than 60 calendar days after you discover a breach of security of unsecured PHR identifiable health information.
Notify prominent media outlets serving a State or jurisdiction, without unreasonable delay and in no case later than 60 calendar days after you discover the breach, when the unsecured PHR identifiable health information of 500 or more of its residents is, or is reasonably believed to have been, acquired during the breach.
If you are a third party service provider, notify the official designated in a written contract by the vendor of personal health records or PHR related entity you serve (or else a senior official of that vendor or entity), without unreasonable delay and in no case later than 60 calendar days after you discover the breach; identify each customer of that vendor or entity whose unsecured PHR identifiable health information has been, or is reasonably believed to have been, acquired during the breach; and obtain acknowledgment that the notice was received.
Notify affected individuals without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information.
For a breach of unsecured protected health information involving more than 500 residents of a State or jurisdiction, notify prominent media outlets serving that State or jurisdiction without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If you are a business associate, notify the covered entity of a breach of unsecured protected health information without unreasonable delay and in no case later than 60 calendar days after discovery of the breach.
If your organization is a derivatives clearing organization, notify staff of the Division of Clearing and Risk promptly of any hardware or software malfunction, security incident, or targeted threat that materially impairs, or creates a significant likelihood of material impairment of, automated system operation, reliability, security, or capacity, and of any activation of your business continuity and disaster recovery plan.
If your organization is a designated contract market, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and significant systems malfunctions and activations of your business continuity-disaster recovery plan.
If your organization is a swap execution facility, notify Commission staff promptly of all cyber security incidents or targeted threats that actually or potentially jeopardize automated system operation, reliability, security, or capacity, as well as electronic trading halts and material system malfunctions and activations of your business continuity-disaster recovery plan.
Evidence of sabotage, subversive activity, or an actual or threatened cyber incident involving or endangering any vessel, harbor, port, or waterfront facility must be reported immediately to the Federal Bureau of Investigation, the Cybersecurity and Infrastructure Security Agency (for any cyber incident), and the Captain of the Port, or to their respective representatives.
Which of these one incident starts turns on the facts: the incident method works that through. The clocks document draws every clock in the LexLint law library on one axis, with the sentence beside every rung.
AIDrafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
This page covers the instruments LexLint has researched
to a stage. Instruments named in the law library but not yet researched are
counted in the head and are not listed here. Every entry carries its own
primary source on its note page. This is a research index, not legal
advice.
