South Dakota Becomes 49th State To Pass Data Breach Notification Law

Once it becomes law, a bill passed unanimously by the South Dakota legislature will make South Dakota the 49^th state with a data breach notification law. (Alabama, the only state left without a data breach notification law, is working on passing its own law). South Dakota's new bill comes with the enforcement date looming ahead for the European Union's (EU's) General Data Protection Regulation (GDPR), which for the first time introduces a broad security breach notification obligation in the EU. Therefore, now is the time for companies to review and update their incident response programs.

Key provisions of South Dakota's Senate Bill 62 follow similar trends seen in other recent state data breach notification legislation. For example, the South Dakota bill provides a more expansive definition of personal information, and would make the state one of the many states requiring companies to provide notice of a breach within a specific number of days. In this case,