What does South Dakota's data breach law ask a business to do?

Who does this law apply to?

The law applies to an information holder: any person or business that conducts business in South Dakota and owns or licenses computerized personal or protected information of its residents. The holder must tell any resident whose information was, or is reasonably believed to have been, acquired by an unauthorized person.

No notice is due if, after an appropriate investigation and notice to the attorney general, the holder reasonably decides the breach will not likely result in harm. The holder must keep that decision in writing.

"Information holder," any person or business that conducts business in this state, and that owns or licenses computerized personal or protected information of residents of this state;

Following the discovery by or notification to an information holder of a breach of system security an information holder shall disclose in accordance with § 22-40-22 the breach of system security to any resident of this state whose personal or protected information was, or is reasonably believed to have been, acquired by an unauthorized person.

An information holder is not required to make a disclosure under this section if, following an appropriate investigation and notice to the attorney general, the information holder reasonably determines that the breach will not likely result in harm to the affected person.

What counts as personal information?

Personal information is a first name or first initial and last name together with another listed item. The list in the text includes a social security number, a driver's licence or other government ID number, a financial account or card number with the code that opens it, health information, and an employer ID number with its code or biometric data.

Protected information also counts: a user name or email address together with a password, security answer or other information that opens an online account.

"Personal information," a person's first name or first initial and last name, in combination with any one or more of the following data elements:

A user name or email address, in combination with a password, security question answer, or other information that permits access to an online account;

How fast must people be told?

Notice is due not later than sixty days from discovery or notification of the breach, unless law enforcement needs more time.

A disclosure under this section shall be made not later than sixty days from the discovery or notification of the breach of system security, unless a longer period of time is required due to the legitimate needs of law enforcement as provided under § 22-40-21.

Who else must be told?

The attorney general must be told, by mail or email, of any breach that exceeds two hundred fifty South Dakota residents.

When notice to residents is due, the holder must also tell the nationwide consumer reporting agencies and credit bureaus, without unreasonable delay, about the timing, distribution and content of the notice.

Any information holder that experiences a breach of system security under this section shall disclose to the attorney general by mail or electronic mail any breach of system security that exceeds two hundred fifty residents of this state.

If an information holder discovers circumstances that require notification pursuant to § 22-40-20 the information holder shall also notify, without unreasonable delay, all consumer reporting agencies, as defined under 15 U.S.C. § 1681a in effect as of January 1, 2018, and any other credit bureau or agency that compiles and maintains files on consumers on a nationwide basis, of the timing, distribution, and content of the notice.

Is encrypted information treated differently?

Yes. A breach is the unauthorized acquisition of unencrypted data, or of encrypted data together with its encryption key.

"Breach of system security," the unauthorized acquisition of unencrypted computerized data or encrypted computerized data and the encryption key by any person that materially compromises the security, confidentiality, or integrity of personal or protected information maintained by the information holder.

What can an outside reading show for this rule?

This law is about what a business does after a breach: who it tells, and how fast. An outside reading cannot tell whether a breach has happened inside your systems, what personal information you hold, whether it is encrypted where you keep it, or whether anyone has been told.

What it can show, read from outside the way anyone could, is evidence about ways someone could get in: whether your domain publishes a rule telling mail servers to refuse email forged in your name, whether remote access or file sharing services answer from the internet, and whether addresses at your domain are listed in monitored breach databases.

The text names none of these. They are evidence about how a breach could start, never proof that a firm meets the law.

Is this legal advice?

No. This summarises the public text; it is not legal advice.

The text itself is the authority. Read it at the source below.