Insurers Face South Carolina Breach Notice, Security Standards

Insurance companies licensed in South Carolina must have a written cybersecurity program and notify state insurance authorities of breaches within 72 hours after a law takes effect in the new year.

South Carolina is the first state to enact a version of a data security model law drafted by the National Association of Insurance Commissioners. Privacy attorneys told Bloomberg Law they expect more states to adopt similar laws governing the industry’s data security practices.

“If they have not done so already, insurance company boards should be working with their company’s data security experts and other advisers to put in place ...