Law / United States / 
South Dakota
Breach of system security, notification statute
SDCL secs. 22-40-19 to 22-40-26 (SL 2018 ch. 135)
In force since .
A breach notification rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- none
What it requires
- Notify each affected South Dakota resident of a breach of system security not later than 60 days after discovery, absent a law enforcement delay.
- Notify the South Dakota Attorney General by mail or electronic mail if a breach affects more than 250 South Dakota residents. This threshold is 250, not 250,000.
- Treat biometric data as a breach-notification trigger only when it is paired with an employer-assigned identification number used for authentication, not on its own.
- Do not assume a private right of action is settled either way for a notice violation here. It is left as an open question here: a deeming-plus-UDAP chain to SDCL sec. 37-24-31 exists in the text with no exclusivity clause closing it, but no confirming case is located.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does SDCL 22-40-25, which says the attorney general 'may prosecute' a failure to disclose 'as a deceptive act or practice under SDCL 37-24-6', make that failure an act 'declared to be unlawful by SDCL 37-24-6' for the private damages action in SDCL 37-24-31?
What it makes you log
What the log must hold
Decision basis
Log retention
Applies to the written no-harm determination only.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
An information holder need not notify affected residents if, after an appropriate investigation and notice to the Attorney General, it reasonably determines that the breach will not likely result in harm. It must document that determination in writing and keep the documentation for not less than three years. The three-year figure applies to that determination record only. The section does not say the Attorney General may demand the documentation (the Attorney General receives notice of the determination and, separately, a report of any breach exceeding two hundred fifty residents), so no regulator access or audit value is coded. A notification procedure kept in an information security policy (22-40-23) is a policy, and the notice to consumer reporting agencies (22-40-24) is a report, not a record. The reach is an information holder that conducts business in this state and owns or licenses information of residents of this state (22-40-19(3)), with the notice owed to any resident of this state (22-40-20).
- Kind
- Explicit
- As of
- Provision
- SDCL sec. 22-40-20 (written determination that a breach will not likely cause harm, kept at least three years)
- Trigger
- security_incident
What this law does
Following discovery of a breach of system security, an information holder must disclose the breach to any affected South Dakota resident not later than 60 days from discovery, absent a law-enforcement delay. An information holder whose breach exceeds 250 South Dakota residents (not 250,000, correcting an initial WebSearch summary against the enrolled bill's own text) must also disclose the breach to the Attorney General by mail or electronic mail.
Personal information excludes information lawfully made available to the general public from government records; it folds in biometric data only in a narrow, conditional way, as one component of an employer-assigned identification number used for authentication, not as a freestanding sensitive category. The Attorney General may prosecute a failure to disclose as a deceptive act under SDCL sec. 37-24-6 and may separately bring an action for a civil penalty of up to $10,000 per day per violation.
South Dakota's general Deceptive Trade Practices and Consumer Protection chapter independently arms any person adversely affected by a sec. 37-24-6 violation with a private civil action for actual damages (SDCL sec. 37-24-31), and unlike the comparable enforcement clauses in Pennsylvania, South Carolina's Chapter 80, or West Virginia, this breach statute's enforcement section contains no exclusivity language naming the Attorney General as the sole enforcer.
Whether this deeming-plus-private-action chain actually arms a resident to sue over a notice violation is left here as an open, statute-supported question rather than a settled finding, since no case construing sec. 22-40-25 together with sec. 37-24-31 was found.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .