Skip to content

Cyber Liability by state

South Dakota data breach notification law and cyber insurance

Direct answer

What is South Dakota's data breach notification law?

South Dakota's breach notification law (S.D. Codified Laws sect. 22-40-19 et seq.) requires businesses to notify affected residents not later than 60 days from discovery or notification of the breach after a breach of personal information. South Dakota requires businesses to notify affected residents within 60 days of discovering a breach, with Attorney General notice when more than 250 residents are affected.

Reviewed by Cornerstone Staff28 years of financial services state licensing experienceLast verified July 29, 2026

What the statute requires

South Dakota requires businesses to notify affected residents within 60 days of discovering a breach, with Attorney General notice when more than 250 residents are affected. Cyber liability insurance typically covers the forensics, notification, and legal review this deadline demands.

Consumer notification deadline
Not later than 60 days from discovery or notification of the breach
Regulator notice
Notify the South Dakota Attorney General when a breach affects more than 250 residents.
Credit bureau notice
Notify consumer reporting agencies when a breach requires notice to more than 250 residents.
Safe harbor
Notification is not required if the compromised data was encrypted and the key was not acquired, or where an investigation finds the breach is not likely to result in harm.
Enforcement
Violations are deceptive acts enforceable by the Attorney General, who may seek civil penalties per day per violation.

Statutes and sources

  • South Dakota Notice of Data Breach Law

    S.D. Codified Laws sect. 22-40-19 et seq.

Regulator: South Dakota Attorney General . Last verified 2026-07-29 from the official source .

Get South Dakota coverage handled

Share a few details and an agent will respond within one business day.