language: en · status: in-force · last checked: 2026-10-08

South Dakota — notice of breach of system security (SDCL 22-40-19 to 22-40-26)

South Dakota's data-breach statute, enacted as SL 2018, ch 135, which sits in SDCL chapter 22-40 (Identity Crimes). The act (2018 Senate Bill 62, signed by the Governor on 26 March 2018) prescribes no effective date and has no emergency clause, so under SDCL 2-14-16 it took effect on 1 July 2018. It binds any information holder, meaning any person or business that conducts business in the state and owns or licenses computerized personal or protected information of South Dakota residents. South Dakota has no operator-binding student-privacy statute, so this is the state statute that reaches an EdTech vendor directly.

Applicability to EdTech

• A vendor holding residents' data is an information holder (SDCL 22-40-19(3)). "Protected information" includes "A user name or email address, in combination with a password, security question answer, or other information that permits access to an online account" (SDCL 22-40-19(5)(a)), so platform account credentials are covered.
• Notice within sixty days to every affected resident, and to the attorney general when a breach exceeds 250 residents. A no-harm determination is possible only after an appropriate investigation and notice to the attorney general, and must be documented and kept for at least three years (SDCL 22-40-20).
• Consumer reporting agencies must also be notified (SDCL 22-40-24). An information holder's own notification policy satisfies the method rules if it meets the timing (SDCL 22-40-23).

Contents

Key obligations at a glance

• Notify affected residents no later than sixty days after discovery or notification — SDCL 22-40-20.
• Notify the attorney general when a breach exceeds 250 residents — SDCL 22-40-20.
• Notify consumer reporting agencies without unreasonable delay — SDCL 22-40-24.

Enforcement

The attorney general may prosecute each failure to disclose as a deceptive act or practice under § 37-24-6, and may recover a civil penalty of not more than ten thousand dollars per day per violation, plus fees and costs (SDCL 22-40-25).

Licence

The corpus reproduces SDCL 22-40-19 to 22-40-26 verbatim from the South Dakota Legislative Research Council's statute service.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held that "officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties". The per-section documents served by the LRC (sdlegislature.gov/api/Statutes/22-40-19.html, read 2026-10-08) carry no copyright notice.

Conditions: none. The corpus names the source in Sources and in each section's {.meta} provenance line.

Related

• South Dakota student data reporting and privacy of records (SDCL 13-3-51 to 13-3-51.6) — the state's student-records statute, which binds the Department of Education
• Kentucky personal information security (KRS 61.931–61.933) — a breach regime that reaches school suppliers by name

Sources

• South Dakota Legislature — SDCL 22-40-19
• South Dakota Legislature — SDCL chapter 22-40
• South Dakota Legislature — 2018 Senate Bill 62, enrolled — the act as passed; no effective-date or emergency section
• South Dakota Legislature — 2018 Senate Bill 62, bill history — SL 2018, ch 135 (93rd regular session); "Signed by the Governor" 26 March 2018
• South Dakota Legislature — SDCL 2-14-16 — an act which does not prescribe when it shall take effect, "if passed at a regular session, takes effect on the first day of July after its passage"