Data Breach Notice to Residents and State Authorities in South Dakota
At a glance
| Covered entity and service provider | SD-doing-business owner/licensee of computerized resident PI or protected information is the information holder that gives resident notice (§§ 22-40-19(3), 22-40-20) |
|---|---|
| Breach and covered information | Unauthorized acquisition of unencrypted computerized PI/protected information, OR encrypted data with key, materially compromising it; named identifiers include health and employer ID plus credential, while protected account credentials may stand alone (§ 22-40-19(1),(4)-(5)) |
| Risk screen or notice exception | After appropriate investigation and AG notice, reasonable no-likely-harm finding avoids resident notice; document decision in writing and retain ≥3 years; good-faith employee/agent acquisition excluded if no misuse/disclosure (§§ 22-40-19(1), 22-40-20) |
| Individuals who receive notice | SD resident whose personal OR protected information was/likely was acquired by unauthorized person (§ 22-40-20) |
| Individual notice deadline and clock | Within 60 days from discovery or notification of breach; law-enforcement criminal-investigation delay ends ≤30 days after clearance (§§ 22-40-20–21) |
| Regulator threshold and deadline | AG notice by mail/email for breach exceeding 250 SD residents; AG notice also prerequisite to no-harm exception; § 22-40-20 states no distinct fixed AG day count (§ 22-40-20) |
| Consumer-reporting-agency notice | Whenever circumstances require resident notice, notify all nationwide consumer-reporting agencies and other nationwide credit bureaus without unreasonable delay of timing, distribution, content; no numeric threshold (§ 22-40-24) |
| Individual delivery and content | Writing or qualifying federal E-SIGN/primary-channel electronic notice, or eligible substitute; no separate list of resident-letter contents in notice sections (§§ 22-40-20, 22-40-22) |
| Substitute notice conditions and channels | Cost >$250,000, class >500,000, or insufficient contact; use available email, website posting if maintained, AND statewide media (§ 22-40-22(3)) |
| Delays and alternate compliance | Law-enforcement impediment determination permits delay, but notice ≤30 days after clearance; own-policy notice must keep timing; compliant federal-regulator procedure route (§§ 22-40-21, 22-40-23, 22-40-26) |
Requirements one by one
Covered information and harm decision
An "information holder" is a person or business doing business in South Dakota that owns or licenses computerized resident personal or protected information (§ 22-40-19(3)). The breach definition requires unauthorized acquisition of unencrypted data or encrypted data together with its key, materially compromising that information (§ 22-40-19(1)). Protected information includes online account login credentials even without a person's name.
The holder tells residents whose information was or likely was acquired by an unauthorized person (§ 22-40-20). It can omit resident notice only after an appropriate investigation, notice to the attorney general, and a reasonable finding that harm is unlikely. The finding must be written and kept at least three years.
Clocks and additional recipients
Resident disclosure is due not later than 60 days from discovery or notification of the breach (§ 22-40-20). If law enforcement determines notice would impede a criminal investigation, the eventual notice is due within 30 days after it determines notification will no longer compromise the investigation (§ 22-40-21).
Section 22-40-20 separately requires mail or email notice to the attorney general when a breach exceeds 250 South Dakota residents. It does not give a separate numeric day deadline for this authority notice. Section 22-40-24 requires notice to all nationwide consumer-reporting agencies and other nationwide credit bureaus whenever circumstances require resident notice, without a headcount threshold and without unreasonable delay.
Delivery
Section 22-40-22 permits writing, electronic notice meeting the cited federal electronic-signature rule or the holder's primary communication practice, or substitute notice. The statute does not set a separate resident-letter content list. Substitute notice becomes available if direct notice would cost more than $250,000, the affected class exceeds 500,000, or contact information is insufficient; it combines available email, a website posting if maintained, and statewide media.
Under § 22-40-23 an own-policy procedure can satisfy the notice-method rule if it meets the statute's timing requirements and the holder follows it. Section 22-40-26 recognizes a qualifying federal-regulator procedure when the holder gives notice under the applicable federal law or regulation.
What trips people up
The no-harm route still involves the attorney general. The holder must notify the attorney general before relying on it and retain its written determination for three years (§ 22-40-20).
Credit-bureau notice has no 250-person floor. The 250-resident figure belongs to the attorney-general route; § 22-40-24 attaches nationwide reporting-agency notice to circumstances requiring resident disclosure.
Common questions
Are account credentials covered without a resident's name?
Yes. Section 22-40-19(5) separately defines protected information to include a username or email address plus credentials permitting online-account access.
Can a holder rely on its own notification policy without regard to the deadline?
No. Section 22-40-23 requires that policy to be consistent with statutory timing.
Does law-enforcement clearance restart a full 60 days?
No. Section 22-40-21 supplies an outside 30-day period after the agency determines notice will not compromise the investigation.
Statutes and sources
- S.D. Codified Laws § 22-40-19 — definitions and covered data.
- S.D. Codified Laws § 22-40-20 — resident and attorney-general notice.
- S.D. Codified Laws § 22-40-21 — criminal-investigation delay.
- S.D. Codified Laws § 22-40-22 — delivery and substitute notice.
- S.D. Codified Laws § 22-40-23 — own-policy route.
- S.D. Codified Laws § 22-40-24 — nationwide consumer-reporting-agency notice.
- S.D. Codified Laws § 22-40-26 — federal-regulator compliance route.
Current official South Dakota statutes checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does South Dakota law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current South Dakota law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace