Duty LXD-1082
Processes personal data, in South Dakota
Breach of system security, notification statutesince 4 lines
SDCL secs. 22-40-19 to 22-40-26 (SL 2018 ch. 135) · Read the law's page
- Notify each affected South Dakota resident of a breach of system security not later than 60 days after discovery, absent a law enforcement delay.
- Notify the South Dakota Attorney General by mail or electronic mail if a breach affects more than 250 South Dakota residents. This threshold is 250, not 250,000.
- Treat biometric data as a breach-notification trigger only when it is paired with an employer-assigned identification number used for authentication, not on its own.
- Do not assume a private right of action is settled either way for a notice violation here. It is left as an open question here: a deeming-plus-UDAP chain to SDCL sec. 37-24-31 exists in the text with no exclusivity clause closing it, but no confirming case is located.
Genetic Data Privacy Act, definitions, consent, and consumer rightssince 3 lines
SDCL secs. 37-24-59 to 37-24-61 (SB 49, SL 2026 ch. 164, secs. 1-3) · Read the law's page
- Obtain a South Dakota consumer's opt-in express consent, separately for collection, third-party transfer, research use, retention beyond the initial test, and marketing use of genetic data or a biological sample, if you operate a direct-to-consumer genetic testing service.
- Honor a consumer's revocation of consent and destroy their biological sample within 30 days.
- Do not treat this Act as reaching biometric data. It is scoped to genetic data and direct-to-consumer genetic testing companies only.
Educational institutions: admission inquiries and records on protected characteristicsin force1 line
SDCL sec. 20-13-22(3) · Read the law's page
- If you are an educational institution in South Dakota, public or private, or act as its agent, do not make or use a written or oral inquiry or an admission application form that elicits or attempts to elicit information concerning an applicant's race, color, creed, religion, ancestry, disability, or national origin, and do not make or keep a record concerning them, except as regulations of the Commission of Human Rights permit; a bona fide religious institution with a religion-based qualification related to a bona fide religious purpose is exempt (SDCL secs. 20-13-1(5) and 20-13-22(3)).