South Dakota’s data breach notification law comes into force today, following Alabama’s law in June. Together they mean that all 50 US states now have data breach notification laws.
Key points
- Notification duties depend on where affected individuals live, not where the organisation is based.
- Definitions of personal information vary, with some states including biometrics or online credentials.
- Deadlines vary, from “without unreasonable delay” to fixed periods such as 30 or 60 days.
- Some states also require notice to the Attorney General or regulators.
UK organisations holding personal data about US residents should map where those individuals live and prepare incident response plans that can meet multiple state requirements at once.
Source: South Dakota Codified Laws Chapter 22-40 (South Dakota Legislature)
Need help understanding what this change means for your organisation? Get in touch for a pragmatic, no-obligation conversation.
