South Dakota Cybersecurity Law

March 31, 2025

South Dakota Cybersecurity Laws

South Dakota’s Senate Bill 62

• The South Dakota Data Breach Notification Law was enacted in 2018
• The law requires entities that conduct business in South Dakota, and that own or license computerized personal information of South Dakota residents, to notify affected individuals of the unauthorized acquisition of their unencrypted personal information.
• Notice must be made within 60 days of discovering the breach. Consumer reporting agencies and any credit bureaus must be notified without unreasonable delay.
• If more than 250 South Dakota residents must be notified, breached entities must also notify the Attorney General.
• Notice is not required if, following appropriate investigation and notification to the Attorney General, the entity reasonably believes the breach will not result in harm to affected individuals.
• A substitute notice is permitted in specific circumstances and notification may be delayed for law enforcement purposes.
• Entities in compliance with relevant federal and state regulations, HIPAA or the GLBA are deemed to comply with this law.
• Entities which maintain their own notification procedures as part of an information security policy consistent with state law are deemed to comply with the notification requirements of this law if the entity makes notifications in accordance with its policies.
• Financial organizations in compliance with the GLBA are deemed to comply with this law, as are those that are compliant with the Federal Interagency Guidance Response Programs for Unauthorized Access to Consumer Information and Customer Notice.
• The Attorney General is authorized to impose fines of up to $10,000 per day, per violation.

Categories: Breach Laws, States

Tags: Define rmm, cyber risk assessment, South Dakota, data security law, NAIC