Skip to content
Network USA

SD · Breach notification statute

South Dakota data breach notification law

A summary of the South Dakota breach notification statute from the Privacy Rights Clearinghouse 2026 survey (laws as of 1 January 2026). This is not legal advice. Verify against the current statute and your state attorney general.

Summary

Statute citation

S.D. Codified Laws §§ 22-40-19 to 22-40-26 (Identity Crimes - Breach of System Security) (amended 2018)

Last amended
2018 (as stated in the citation)
Source
PRC Data Breach Notification Laws Survey 2026

Who must notify and when

60 days South Dakota requires information holders (including businesses/persons) to notify affected

Attorney general notice

Yes South Dakota requires notification to the Attorney General for breaches affecting more than 250

What counts as a breach

In South Dakota 'breach of system security' means the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder; the term does not include the good faith acquisition of personal or protected information by an employee or agent of the information holder for the purposes of the informati

What counts as personal information

Not extracted in our PRC 2026 summary; check the statute.

Coverage and remedies

Biometric dataYes
Medical informationYes
Government ID numbersNot extracted
Paper recordsNo
Private right of actionYes
Credit monitoring requiredNo

"Not extracted" means the field was not captured in our PRC 2026 summary; check the statute.

HIPAA breaches reported in South Dakota

15 reports to HHS OCR affecting 178,652 individuals. Most common type: Hacking/IT Incident. See all HIPAA breaches in South Dakota.

Five largest

HIPAA breach reports from the HHS OCR Breach Portal
Covered entityEntity typeIndividualsSubmittedType of breachStatus
Black Hills Regional Eye InstituteHealthcare Provider106,763Mar 31, 2025Hacking/IT IncidentArchive (closed)
Huron Regional Medical Center, Inc.Healthcare Provider25,398Jun 6, 2025Hacking/IT IncidentUnder investigation
Siouxland Anesthesiology, Ltd.Healthcare Provider13,000Jul 31, 2015Hacking/IT IncidentArchive (closed)
Plastic Surgery Associates of South DakotaHealthcare Provider10,229Jul 27, 2017Hacking/IT IncidentArchive (closed)
Stronghold Counseling Services, Inc.Healthcare Provider8,500Feb 21, 2013TheftArchive (closed)

Frequently asked questions

When must South Dakota businesses notify individuals of a data breach?

Our PRC 2026 extract summarises the South Dakota timing rule as: "60 days South Dakota requires information holders (including businesses/persons) to notify affected". (Source: PRC 2026 survey extract.)

Does South Dakota require notice to the attorney general?

The PRC 2026 extract notes: "Yes South Dakota requires notification to the Attorney General for breaches affecting more than 250". (Source: PRC 2026 survey extract.)

Does the South Dakota law cover biometric data?

Yes. The PRC 2026 survey records biometric data as covered by the South Dakota breach law.

Does the South Dakota law cover medical information?

Yes. The PRC 2026 survey records medical information as covered by the South Dakota breach law.

Does the South Dakota law cover paper records?

No. The PRC 2026 survey records the South Dakota law as covering computerised data only, not paper records.

Is there a private right of action in South Dakota?

Yes. The PRC 2026 survey records a private right of action under the South Dakota breach law.

Is credit monitoring required in South Dakota?

No. The PRC 2026 survey does not record a credit monitoring requirement in South Dakota.

How does the South Dakota law relate to HIPAA?

HIPAA covered entities and business associates follow the federal HIPAA Breach Notification Rule for protected health information. State breach laws can apply alongside it, and some state statutes treat HIPAA compliance as satisfying state duties. Check the South Dakota statute, and see our HIPAA vs state breach notification laws guide.

Sources