Skip to content

When Your Data Is Breached

SDCL § 22-40-20 — notice to each resident within sixty days, and to the attorney general past two hundred fifty

Sixty days. A business that holds personal information and suffers a breach discloses it to each affected resident within sixty days of discovering it, unless law enforcement needs a delay.

  • SDCL § 22-40-20
Email

Notice is not required if, after investigating and telling the attorney general, it reasonably finds harm unlikely, and keeps that finding in writing for three years.

  • SDCL § 22-40-20

A breach affecting more than two hundred fifty residents is also reported to the attorney general.

  • SDCL § 22-40-20

A particular breach is a question for a licensed South Dakota attorney.

  • SDCL § 22-40-20
Sources for this section (1)
  1. SDCL § 22-40-20 — Notice of breach of system security; Exception

Legal information, not legal advice. Verified as of October 2026. Applying it to a particular situation is the work of a licensed South Dakota attorney.

On the clock

One period on this page runs out. Each is stated above with its authority; this is the same thing with the date attached.

Every deadline in the file →

From here

Walked through

This section is the long version of a step in one walkthrough. Each one takes the same law one decision at a time, with both sides of the moment written out.