Law / United States / 
South Dakota
Insurance licensees, written information security program for customer information
S.D. Admin. R. 20:06:45:20 and 20:06:45:21
In force since .
A sector security regimes rule binding private bodies.
- Instrument type
- a regulation made under an act
- Obligation class
- Security
As of .
What it requires
- Applies to a licensee: an insurer, producer or other person licensed, authorized or registered, or required to be, under South Dakota insurance law; declare is_insurer where you hold that status. The chapter reaches only nonpublic personal information about individuals who obtain products or services primarily for personal, family, or household purposes, and does not apply to information about companies or about individuals who obtain products or services for business, commercial, or agricultural purposes.
- Implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information, appropriate to the size and complexity of the licensee and the nature and scope of its activities.
- Design the program to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
- A licensed producer that needs only a minimum level of safeguards given its size and complexity may meet the duty with physical safeguards that keep nonpublic personal information under lock when personnel are not present, technical safeguards that guard electronic information another person could potentially access, and written administrative safeguards on who may receive nonpublic personal information.
These lines are LexLint's reading of the law's text, as of .
What this law does
A licensee must implement a comprehensive written information security program that includes administrative, technical, and physical safeguards for the protection of customer information. The safeguards must be appropriate to the size and complexity of the licensee and the nature and scope of its activities.
The program must be designed to ensure the security and confidentiality of customer information, protect against any anticipated threats or hazards to the security or integrity of the information, and protect against unauthorized access to or use of the information that could result in substantial harm or inconvenience to any customer.
A licensee is all licensed insurers, producers, and other persons licensed or required to be licensed, or authorized or required to be authorized, or registered or required to be registered pursuant to the insurance laws of this state. Customer information is nonpublic personal information about a customer, whether in paper, electronic, or other form, that is maintained by or on behalf of the licensee.
The chapter does not apply to information about companies or about individuals who obtain products or services for business, commercial, or agricultural purposes. The actions and procedures in sections 20:06:45:23 to 20:06:45:26 are non-exclusive illustrations that licensees may follow to implement the program requirements. The rule was adopted , effective , and amended effective .
When LexLint raises it
When your app profile says your app is an insurer.