South Dakota Breach Notification Law (SDCL Chapter 22-40-19 to 22-40-26)

Establishes requirements for notification of data breaches affecting South Dakota residents. Mandates disclosure within 60 days of breach discovery. Requires notification to the state attorney general for breaches affecting over 250 residents. Includes criminal penalties for failing to disclose breaches.

Analysis

Key Requirements

• Notification to Affected Individuals: Entities must notify any South Dakota resident whose unencrypted personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person. Notification must occur as soon as possible, but no later than 60 days after discovery of the breach, unless law enforcement determines that notification would impede a criminal investigation. In such cases, notification must occur within 30 days after law enforcement determines it will not impede the investigation. South Dakota Legislature - SDCL 22-40-20 Insureon - South Dakota Data Breach Notification Laws Davis Wright Tremaine - South Dakota Data Breach Summary

• Notification to State Attorney General: If a breach affects more than 250 South Dakota residents, the entity must also notify the South Dakota Attorney General without unreasonable delay. South Dakota Legislature - SDCL 22-40-20 Insureon - South Dakota Data Breach Notification Laws

• Notification to Consumer Reporting Agencies: If the breach requires notification of any individuals, the entity must also notify nationwide consumer reporting agencies (such as Equifax, TransUnion, Experian) without unreasonable delay. Insureon - South Dakota Data Breach Notification Laws

• Harm Threshold and Documentation: Notification is not required if, after investigation and notification to the Attorney General, the entity determines the breach is not likely to result in harm to affected individuals. This determination must be documented and retained for at least three years. Davis Wright Tremaine - South Dakota Data Breach Summary

• Permitted Notification Methods: Notification may be provided in writing, electronically (if that is the entity’s primary method of communication), or by substitute notice if certain thresholds are met (e.g., notification cost exceeds $250,000, more than 500,000 affected, or insufficient contact information). Insureon - South Dakota Data Breach Notification Laws

• Criminal and Civil Penalties: Failure to comply can result in criminal penalties and enforcement actions by the Attorney General. South Dakota Legislature - SDCL 22-40-26 Perkins Coie - Security Breach Notification Chart

Compliance Challenges

• Timely Breach Detection: Organizations often struggle to detect breaches quickly enough to meet the 60-day notification deadline, especially when breaches are sophisticated or go undetected for long periods. Insureon - South Dakota Data Breach Notification Laws

• Determining Harm Threshold: Assessing whether a breach is likely to result in harm and properly documenting this determination can be complex, particularly for organizations without robust incident response procedures. Davis Wright Tremaine - South Dakota Data Breach Summary

• Coordinating Multi-State Notifications: Businesses operating in multiple states must navigate overlapping and sometimes conflicting breach notification laws, increasing administrative burden and risk of non-compliance. Covington - South Dakota Breach Notification Law Analysis (PDF)

• Real Example: In 2018, a healthcare provider operating in several states faced challenges coordinating breach notifications after a ransomware attack, highlighting the complexity of multi-jurisdictional compliance. Covington - South Dakota Breach Notification Law Analysis (PDF)

Implementation Best Practices

• Develop a Written Incident Response Plan: Establish clear procedures for breach detection, investigation, notification, and documentation. NIST Computer Security Incident Handling Guide FTC Data Breach Response Guide

• Conduct Regular Security Training: Train staff to recognize and report potential breaches promptly. FTC Cybersecurity for Small Business

• Use Automated Monitoring Tools: Implement security information and event management (SIEM) systems to detect unauthorized access and data exfiltration. SANS Security Incident Response Tools

• Maintain Documentation: Keep thorough records of breach investigations, harm assessments, and notifications for at least three years as required. Davis Wright Tremaine - South Dakota Data Breach Summary

Recent Updates

• Enactment of Law: South Dakota’s breach notification law (S.B. 62) was signed into law on March 21, 2018, and became effective July 1, 2018. South Dakota Legislature - S.B. 62 Covington - South Dakota Breach Notification Law Analysis (PDF)

• No Major Amendments Since 2018: As of April 2025, there have been no significant amendments or updates to the core requirements of the South Dakota Breach Notification Law. South Dakota Legislature - Codified Laws Davis Wright Tremaine - South Dakota Data Breach Summary

Related Regulations

| Regulation | Description | Interaction/Overlap | Official Link | |------------|-------------|---------------------|--------------| | HIPAA | Federal law for healthcare data privacy and breach notification | Entities subject to HIPAA must comply with both HIPAA and South Dakota law if a breach affects SD residents | HHS HIPAA Breach Notification Rule | | GLBA | Federal law for financial institutions’ data security | Financial institutions must comply with both GLBA and SD law for breaches involving SD residents | FTC GLBA Safeguards Rule | | Other State Laws | All 50 states have breach notification laws | Multi-state breaches require compliance with each applicable state law | National Conference of State Legislatures - Security Breach Notification Laws |

Industry Impact

• Healthcare: Providers must comply with both HIPAA and South Dakota law, increasing administrative complexity and potential penalties for non-compliance. HHS HIPAA Breach Notification Rule Covington - South Dakota Breach Notification Law Analysis (PDF)

• Financial Services: Banks and credit unions face overlapping requirements under GLBA and state law, necessitating robust incident response and documentation. FTC GLBA Safeguards Rule Davis Wright Tremaine - South Dakota Data Breach Summary

• Small Businesses: Smaller organizations may lack resources for compliance, making them more vulnerable to penalties and reputational harm. Insureon - South Dakota Data Breach Notification Laws FTC Cybersecurity for Small Business

Sources

• South Dakota Legislature - SDCL 22-40-20
• South Dakota Legislature - SDCL 22-40-26
• South Dakota Legislature - S.B. 62
• South Dakota Legislature - Codified Laws
• Insureon - South Dakota Data Breach Notification Laws
• Davis Wright Tremaine - South Dakota Data Breach Summary
• Perkins Coie - Security Breach Notification Chart
• Covington - South Dakota Breach Notification Law Analysis (PDF)
• NIST Computer Security Incident Handling Guide
• FTC Data Breach Response Guide
• FTC Cybersecurity for Small Business
• SANS Security Incident Response Tools
• HHS HIPAA Breach Notification Rule
• FTC GLBA Safeguards Rule
• National Conference of State Legislatures - Security Breach Notification Laws

Recent developments

• 2025-10-17 — Recent legal analysis notes that South Dakota’s breach notification law still requires notice within 60 days of discovery, with no major statutory amendments reported in 2025, but highlights ongoing national trends toward shorter notification deadlines[7]. (source)

Related regulations

• UK Data Protection Act 2018 — United Kingdom, Active
• Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
• General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
• COPPA (Children's Online Privacy Protection Act) — United States, Active
• Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
• Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
• New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
• Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01

Put it into practice

• Generate the policy: Privacy policy generator (generatepolicy.com)
• Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
• Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)

Browse all regulations · Compliance deadlines · Latest updates