Data breach notification
South Dakota's notice of breach of system security rules are S.D. Codified Laws §§ 22-40-19 to 22-40-26.
They set a hard outer limit of sixty days for telling affected people.
"A disclosure under this section shall be made not later than sixty days from the discovery or notification of the breach of system security."
The attorney general hears about it by mail or email for "any breach of system security that exceeds two hundred fifty residents of this state."
So a breach touching a few hundred South Dakotans already reaches the attorney general.
South Dakota separates personal information from protected information.
Personal information is a first name or initial and last name with a Social Security number; a driver's license or other government ID number; an account or card number with any required code, password, routing number or PIN; health information as defined in 45 CFR 160.103; or an employer-assigned ID number with any required code, password or biometric data.
Protected information needs no name. It covers "a user name or email address, in combination with a password, security question answer, or other information that permits access to an online account", and an account or card number with its required code.
A breach is "the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key", so encrypted data counts only when the key went with it.
No disclosure is needed "if, following an appropriate investigation and notice to the attorney general, the information holder reasonably determines that the breach will not likely result in harm to the affected person."
The order matters: the attorney general is told before the holder relies on that finding. The text we checked adds that the determination must be documented and kept for three years.
Teams in Sioux Falls and Rapid City that pass HR files or payment records between offices and advisers face the same question after an incident: who actually opened what.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
The watermark is a per-room setting, on by default. Readers get in with a six-digit code sent to their email rather than an account, groups only see their own folders, and the chained log exports as CSV.
Checked against South Dakota's published law on November 2, 2026. This is general information, not legal advice.
