South Dakota Data Breach Notification Law

The South Dakota data breach notification law: 60 days and the data it covers

Since 2018, South Dakota has given businesses 60 days from discovery or outside notice to reach residents ¹. That is a long fixed window by national standards, yet the statute adds several duties along the way.

If law enforcement needs a delay, the 60 days can stretch. Notice is then due within 30 days after law enforcement says notice will no longer compromise the investigation ¹.

Beyond the standard elements, South Dakota covers medical information (as defined in the HIPAA rules), employer ID numbers when combined with a required code, password or biometric data, online account credentials, and government-issued ID numbers ¹. Online credentials and account numbers with their access codes count even without a name ¹.

Attorney General and credit bureau notices

The resident letters can bring two more filings, and a third if you plan to send no letters at all.

• Attorney General. A breach that exceeds 250 South Dakota residents must be disclosed to the AG by mail or email ¹. The statute sets no separate deadline.
• Credit bureaus. The consumer reporting agencies must be notified of any breach that requires notice to residents, with no minimum count ². Few small businesses expect this.
• AG before skipping notice. A business that wants to rely on the no-harm exception must notify the Attorney General first (see below) ¹.

Following your federal regulator's breach procedures counts as compliance ¹; a clinic will find the federal steps in our summary of HIPAA's notice rule.

The no-harm exception comes with conditions

South Dakota lets a business skip notice only after an appropriate investigation and notice to the Attorney General, and only if it reasonably determines the breach will not likely result in harm ¹. The determination must be documented in writing and kept for at least three years ¹.

Encryption takes data out of scope unless the key was taken too ¹. Since the no-harm route costs an AG notice and a three-year file, encryption is the simpler way to keep a lost laptop out of the law. Get confirmation that laptops, phones and backups are encrypted and that keys live somewhere else.

Enforcement can be expensive. The Attorney General may prosecute each failure to disclose as a deceptive act or practice and seek a civil penalty of up to $10,000 per day per violation ³. The breach law itself neither grants nor bars a private suit, so whether individuals can sue under it is unclear.

When a South Dakota breach starts

With an attack running, an insured South Dakota firm reports the claim first, tells the FBI through an IC3 filing, and reimages nothing until evidence is copied ⁴⁶⁵.

1. Isolate the affected systems with your IT contractor or a breach response firm.
2. Use the lawyer and forensic firm the policy calls for; how carriers set those terms explains why.
3. Count South Dakotans against the 250 line and group the rest by state. North Dakota and Nebraska next door work differently, and all state deadlines are compared in our table.
4. Mark day 60, and plan a bureau notice for every breach that needs letters.

Our review found no section of the statute requiring a vendor to notify the business that owns the data, so put that duty in your contracts. A written information security plan is a good place to record vendor reporting terms.

South Dakota Codified Laws, as checked October 13, 2026, are the basis for this page. Treat it as orientation instead of legal advice and let a South Dakota attorney confirm your duties.