South Dakota. Breach notification. Act
SD breach lawSouth Dakota data breach notification law (S.D. Codified Laws §§ 22-40-19 to 22-40-26)
Partly verified
Medium confidence.Penalty figure from recollection of § 22-40-25; summary page did not state amounts.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about South Dakota residents to notify affected individuals after a security breach. Core timing rule: Individuals within 60 days of discovery. Covered data: name plus SSN, government ID, financial account with codes, HIPAA health information, employer ID with codes/biometric; online credentials.
- Key themes
- Unique features
No-harm exception requires prior notice to the AG and 3-year documentation.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: South Dakota does not set a separate vendor deadline; vendors that discover breaches should notify owners promptly under contract. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals within 60 days of discovery; AG if >250 residents; CRAs without unreasonable delay
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $10,000 per day per violation
§3Dates
- Key dates
- Adopted
- In force
- Enacted SB 62 (2018); no later amendment identified
§4Text and authority
- Text
- Authoritative text sdlegislature.gov
- Authority
- South Dakota Attorney General
§5Where it applies
- Domestic law of
- South Dakota
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figure from recollection of § 22-40-25; summary page did not state amounts.