Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | South Dakota |
|---|---|
| Statute citation | S.D. Codified Laws §§ 22-40-19 to 22-40-26 (Identity Crimes - Breach of System Security) (amended 2018) |
| Individual notice timing | 60 days South Dakota requires information holders (including businesses/persons) to notify affected |
| Attorney general notice | Yes South Dakota requires notification to the Attorney General for breaches affecting more than 250 |
| Biometric data | Yes |
| Medical information | Yes |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | Yes |
| Credit monitoring required | No |
| Breach definition (excerpt) | In South Dakota 'breach of system security' means the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder; the term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the informati |