Full Quilt: The Final Two States Without Data Breach Laws Push Forward To Complete The Patchwork Protecting Personal Information In The U.S.

There are currently only two U.S. states that do not have a state data breach notification law: South Dakota and Alabama. Recently, South Dakota took a big step toward approving a data breach notification law. On January 25, 2018, the state's Senate Attorney Judiciary Committee advanced the bill after a 7–0 vote, sending it to the South Dakota House of Representatives for consideration.

In addition to the standard data elements that are considered by most states with data breach laws, South Dakota Bill No. 62 follows the pattern of other states that are now looking to broaden the definition of "personally indentifiable information" to include elements such as biometrics. Notification will need to be provided without unreasonable delay and no later than 45 days after the breach has been discovered. In addition, when breaches impact more than 250 SD residents, an entity is required to notify not only customers but also the state attorney general's office.