1. Home
  2. State breach laws
  3. South Dakota

South Dakota data breach notification law

What South Dakota requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by S.D. Codified Laws §§ 22-40-19 to 22-40-26.

60 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

South Dakota's 60-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent South Dakota breach filings →

Requirements in detail

Statute
S.D. Codified Laws §§ 22-40-19 to 22-40-26
Deadline to notify residents
No later than 60 days after discovering or being notified of the breach. If law enforcement delays notice because it would impede a criminal investigation, notice is due no later than 30 days after law enforcement says it will no longer compromise the investigation.
Attorney General notification
Yes, by mail or email, when a breach affects more than 250 South Dakota residents. The statute does not set a separate deadline for this notice. An organization that decides after investigation that no harm is likely must still notify the Attorney General before skipping resident notice. Consumer reporting agencies must be notified without unreasonable delay whenever resident notice is required, with no minimum number of people.
Penalties
The Attorney General may prosecute each failure to notify as a deceptive act or practice under the state consumer protection law, and may also seek a civil penalty of up to $10,000 per day per violation, plus attorney's fees and costs.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
South Dakota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. South Dakota has no law limiting breach lawsuits for organizations that maintain a security program.

South Dakota breach notification FAQ

What is the data breach notification deadline in South Dakota?

No later than 60 days after discovering or being notified of the breach. If law enforcement delays notice because it would impede a criminal investigation, notice is due no later than 30 days after law enforcement says it will no longer compromise the investigation. The governing law is S.D. Codified Laws §§ 22-40-19 to 22-40-26.

Does South Dakota require notifying the Attorney General of a data breach?

Yes, by mail or email, when a breach affects more than 250 South Dakota residents. The statute does not set a separate deadline for this notice. An organization that decides after investigation that no harm is likely must still notify the Attorney General before skipping resident notice. Consumer reporting agencies must be notified without unreasonable delay whenever resident notice is required, with no minimum number of people.

What are the penalties for failing to report a data breach in South Dakota?

The Attorney General may prosecute each failure to notify as a deceptive act or practice under the state consumer protection law, and may also seek a civil penalty of up to $10,000 per day per violation, plus attorney's fees and costs.

Can individuals sue over a data breach in South Dakota?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in South Dakota?

South Dakota's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does South Dakota limit breach lawsuits for companies with a cybersecurity program?

No. South Dakota has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the South Dakota Attorney General before relying on them.

Other states with a 60-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →