← All US breach laws·SD

South Dakota data breach notification law

South Dakota's data breach notification requirements under S.D. Codified Laws §§22-40-19 to 22-40-26. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
S.D. Codified Laws §§22-40-19 to 22-40-26
Enforcer
South Dakota Attorney General
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Not later than 60 days from discovery of the breach
Notify the state regulator
Yes — if more than 250 SD residents are affected, written notice to the AG
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification not required if, after appropriate investigation, no likelihood of harm to consumers exists; documentation retained 3 years
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under South Dakota law

First name/initial + last name with SSN, DL/state ID, financial account + access code, health information, employer-assigned ID + access code, OR username/email + password/security Q&A

Penalties and enforcement

Up to $10,000 per day per violation enforceable by AG; deceptive act under Consumer Protection Act
Enforced by: South Dakota Attorney General. Official regulator page →

Common pitfalls

⚠ SD imposes per-DAY penalty (not per-breach) — late notice compounds quickly

Frequently asked questions

How long do I have to notify South Dakota residents after a data breach?
Not later than 60 days from discovery of the breach
Do I have to notify the South Dakota Attorney General?
Yes — if more than 250 SD residents are affected, written notice to the AG
Does South Dakota require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from South Dakota's breach notification requirement?
Yes — South Dakota has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can South Dakota residents sue me directly for a data breach?
No — South Dakota's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under South Dakota law?
First name/initial + last name with SSN, DL/state ID, financial account + access code, health information, employer-assigned ID + access code, OR username/email + password/security Q&A
What are the penalties for failing to comply with South Dakota's breach notification law?
Up to $10,000 per day per violation enforceable by AG; deceptive act under Consumer Protection Act

Related state breach laws

Rhode Island (RI)
R.I. Gen. Laws §§11-49.3-1 to 11-49.3-6
South Carolina (SC)
S.C. Code §39-1-90
Tennessee (TN)
Tenn. Code §47-18-2107
Texas (TX)
Tex. Bus. & Com. Code §521.053

Pre-empt the South Dakota breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against South Dakota's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit