What is the data breach notification deadline in South Dakota?

South Dakota requires notice to affected individuals 60 calendar days from discovery (SDCL §§22-40-19–26).

Do you have to notify the South Dakota Attorney General of a data breach?

Yes. South Dakota Attorney General must be notified.

← All jurisdictions

SD · data breach notification

South Dakota

med

SDCL §§22-40-19–26

Individual deadline

60 days

Trigger standard

Risk of harm

AG / regulator

Required

Notice to individuals	60 calendar days from discovery
Risk-of-harm standard	no notice if, after investigation + AG notice, breach will not likely result in harm
Encryption safe harbor	Yes, encrypted data (key not compromised) generally exempt.
Regulator notice	South Dakota Attorney General, required above 250 residents; without unreasonable delay Written notice (mail/email) to AG
Credit reporting agencies	No CRA-notice requirement.
Substitute notice	Typically available above $250,000 cost / 500,000 affected (verify).
Private right of action	No, enforcement by the state.
Notable PI definitions	Includes biometric, medical, credentials.

Rule last verified July 10, 2026 · confidence med. This is a reference summary, not legal advice; verify against the current statute. How we compile this →

Is a South Dakota breach part of a multi-state incident?

See every jurisdiction at once, with letters and filing packets generated.

Run the calculator →