Notwithstanding § 22-40-22, if an information holder maintains its own notification procedure as part of an information security policy for the treatment of personal or protected information and the policy is otherwise consistent with the timing requirements of this section, the information holder is in compliance with the notification requirements of § 22-40-22 if the information holder notifies each person in accordance with the information holder's policies in the event of a breach of system security.
S.D. Codified Laws § 22-40-23
Notice of breach of system security in accordance with information holder's policies
Source: SL 2018, ch 135, § 5.
Official source: South Dakota Legislature. Reproduced from public-domain South Dakota statutes; confirm against the official source for the current text. Not legal advice.