South Dakota · verified through August 25, 2026

South Dakota: law status and evidence context.

Law status, direct attached-library attribution, and public enforcement context are shown separately. A zero direct total does not mean no enforcement exists.

SD · 6 requirements mapped / control outcomes supported

Law status

No verified general comprehensive law

No comprehensive consumer privacy law verified (SB 111 (2026) was a pending bill)

Official name / citation
n.a.
Status / effective date
Bill only
Principal enforcer
South Dakota Attorney General

Direct attached-library attribution

0 cases · $0

These totals are assigned solely by the attachment’s state heading. Shared multistate totals are not allocated in full to every state.

The attached library does not enumerate participant-level allocations for every multistate matter; shared settlement totals are presented once at the national level and are not duplicated into state totals.

Official law sources

Other generally applicable PII law

SDCL § 22-40-20, notice of breach of system security - https://sdlegislature.gov/Statutes/22-40-20

Public enforcement context

Tier 1

23andMe (bankruptcy claims)

$150 million allowed claims; $18 million available recovery; South Dakota share stated as $149,399 · July 14, 2026

South Dakota joined the multistate 23andMe bankruptcy settlement over the 2023 genetic-data breach.

Legal basis: State privacy/consumer-protection claims in bankruptcy

Official case source (opens in a new tab)

Mapped control outcomes

1 personal data inventory/data map; 2 sensitive-data discovery; 3 downstream copy tracking; 8 breach blast-radius analysis; 9 retention/minimization; 10 regulator audit evidence

Kestryl can evidence where regulated personal data actually resides across structured stores and unstructured attachments/images, produce audit rows and evidence packs showing when each location was discovered and reviewed, and apply structured-data remediation modes (mask, vault, strip) to reduce exposure. It does not alter source attachments or documents, and its output is technical evidence supporting controls, not proof of legal compliance.