Insurance Data Security Act

The South Carolina Insurance Data Security Act requires insurance companies to develop, implement, and maintain an information security program and to notify consumers of data breaches.

Analysis

Key Requirements

The South Carolina Insurance Data Security Act imposes several key requirements on insurance companies and other licensees:

• Develop and implement a comprehensive Information Security Program: Licensees must create a written program based on their risk assessment, containing administrative, technical, and physical safeguards to protect nonpublic information and information systems. This program should be designed to protect against threats, unauthorized access, and potential harm to consumers.

• Conduct regular risk assessments: Companies must perform ongoing assessments to identify potential threats and vulnerabilities to nonpublic information and information systems. This includes evaluating the need for measures like multi-factor authentication, regular penetration testing, and data encryption.

• Oversee third-party service providers: By July 1, 2020, licensees were required to ensure that their third-party service providers implement appropriate security measures to protect information systems and personal information.

• Report data breaches: Licensees must notify the South Carolina Department of Insurance within 72 hours of a cybersecurity event affecting 250 or more South Carolina residents. The notification must include specific details about the breach and its impact.

• Board oversight: The Act requires minimum standards for board of directors' involvement, including regular written reports from executive management on the overall status of the information security program.

• Annual compliance certification: Licensees must submit an annual statement to the Director certifying compliance with the Act.

Compliance Challenges

Organizations face several challenges in complying with the South Carolina Insurance Data Security Act:

• Resource allocation: Smaller insurance companies may struggle to allocate sufficient resources to develop and maintain a comprehensive information security program. This challenge is highlighted in industry reports on cybersecurity implementation.

• Third-party risk management: Ensuring that all third-party service providers comply with security requirements can be complex and time-consuming. The 2021 Prevalent Third-Party Risk Management Study found that 45% of organizations experienced a third-party security incident in the past year.

• Keeping pace with evolving threats: Cybersecurity threats are constantly evolving, making it challenging to maintain an up-to-date and effective security program. The 2021 Verizon Data Breach Investigations Report shows that the threat landscape is continuously changing, requiring constant vigilance.

• Incident response and reporting: Meeting the 72-hour notification requirement for cybersecurity events can be challenging, especially for organizations without robust incident response plans. A 2021 IBM Security study found that the average time to identify and contain a data breach was 287 days.

Implementation Best Practices

To effectively implement the South Carolina Insurance Data Security Act, organizations should consider the following best practices:

• Conduct a thorough risk assessment: Use frameworks like the NIST Cybersecurity Framework to perform comprehensive risk assessments and identify areas for improvement.

• Develop a written information security program: Create a detailed, documented program that addresses all aspects of data security. The SANS Institute provides guidance on developing effective security policies.

• Implement strong access controls: Utilize multi-factor authentication and principle of least privilege. The CIS Controls provide a prioritized set of actions to protect organizations and data from known cyber attack vectors.

• Establish an incident response plan: Develop and regularly test an incident response plan. The NIST Computer Security Incident Handling Guide offers a comprehensive framework for incident response planning.

• Provide regular employee training: Conduct ongoing cybersecurity awareness training for all employees. Resources like the SANS Security Awareness program can be valuable.

• Use encryption for sensitive data: Implement strong encryption for data at rest and in transit. The NIST Cryptographic Standards and Guidelines provide recommendations for encryption implementation.

Recent Updates

As of February 2023, there have been no significant recent updates to the South Carolina Insurance Data Security Act. However:

• The National Association of Insurance Commissioners (NAIC) continues to track state adoptions of the model law, with 26 jurisdictions having implemented it as of February 2023.

• Organizations should regularly check the South Carolina Department of Insurance website for any new guidance or updates related to the Act.

Related Regulations

The South Carolina Insurance Data Security Act is closely related to several other regulations:

• NAIC Insurance Data Security Model Law: The South Carolina Act is based on this model law. The full text of the model law is available from the NAIC.

• New York Department of Financial Services Cybersecurity Regulation: This regulation has similar requirements for financial institutions in New York. The official regulation text is available on the NY DFS website.

• HIPAA Security Rule: For health insurers, there is significant overlap with HIPAA requirements. The HHS provides comprehensive guidance on HIPAA compliance.

• Gramm-Leach-Bliley Act (GLBA): This federal law includes data protection requirements for financial institutions. The FTC provides guidance on GLBA compliance.

Industry Impact

The Insurance Data Security Act has had significant impacts on the insurance industry:

• Increased cybersecurity investment: Insurance companies have had to allocate more resources to cybersecurity measures. A 2021 Deloitte study found that financial institutions, including insurers, are increasing their cybersecurity budgets by 15% annually.

• Enhanced consumer protection: The Act has led to improved data protection practices, benefiting consumers. The Insurance Information Institute reports that these measures contribute to reducing identity theft and cybercrime risks.

• Compliance burden: Smaller insurance companies and agencies may face challenges in meeting the Act's requirements. The Independent Insurance Agents & Brokers of America provides resources to help smaller entities navigate these challenges.

• Standardization of security practices: The Act has helped standardize cybersecurity practices across the insurance industry. The NAIC's 2021 Insurance Data Security Pre-Breach Checklist provides a framework for this standardization.

Sources

• NAIC Insurance Data Security Model Law
• Triaxiom Security: South Carolina Insurance Data Security Act
• Corsica Technologies: South Carolina Insurance Data Security Act Compliance Guide
• South Carolina Department of Insurance: Cybersecurity
• Insurance Journal: Cybersecurity Implementation Challenges
• Prevalent Third-Party Risk Management Study
• Verizon Data Breach Investigations Report
• IBM Security Cost of a Data Breach Report
• NIST Cybersecurity Framework
• SANS Institute Security Policies
• CIS Controls
• NIST Computer Security Incident Handling Guide
• SANS Security Awareness Training
• NIST Cryptographic Standards and Guidelines
• NAIC Government Affairs Brief: Data Security Model Law
• NY DFS Cybersecurity Regulation
• HHS HIPAA Security Rule Guidance
• FTC Gramm-Leach-Bliley Act Compliance
• Deloitte Cybersecurity Study
• Insurance Information Institute: Identity Theft and Cybercrime Statistics
• Independent Insurance Agents & Brokers of America: Cyber Security Resources
• NAIC Insurance Data Security Pre-Breach Checklist

Recent developments

• 2025-12-01 — SEC released its 2026 Examination Priorities in December 2025, focusing on broker-dealer compliance with Regulation S-P safeguards for customer information and incident response, relevant to insurance data security overlaps.[1] (source)

Read the full guide to Insurance Data Security Act

Related regulations

• NYDFS Cybersecurity Regulation — New York, Active, effective 2025-11-01
• Law on Cybersecurity of Vietnam — Vietnam, Active
• Austria NIS2 Act — Austria, Upcoming
• Luxembourg NIS2 Transposition — Luxembourg, Active
• EU Cyber Resilience Act (CRA) — European Union, Phased, effective 2027-12-11
• EU Cyber Resilience Act - Vulnerability and Incident Reporting (11 Sep 2026) — European Union, Active, effective 2026-09-11
• Netherlands NIS2 Transposition (Cyberbeveiligingswet) — Netherlands, Active, effective 2026-08-15
• Belgium NIS2 Transposition — Belgium, Active, effective 2024-10-18

Put it into practice

• Generate the policy: Privacy policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates