South Dakota Biometric Privacy Laws: Collection, Consent & Penalties (2026)

South Dakota has no dedicated biometric privacy law and no consent requirement for collecting biometric identifiers such as fingerprints, face scans, or voiceprints. The state's breach notification statute, SDCL 22-40-20, is the main protection for those identifiers, requiring businesses to notify residents within 60 days when a breach exposes biometric authentication data. Genetic data is the one carve-out: SDCL 37-24-59 to 37-24-64 impose express-consent duties on direct-to-consumer genetic testing companies.

South Dakota takes a minimal approach to biometric privacy regulation. Unlike states such as Illinois or Texas that have enacted specific biometric privacy statutes, South Dakota protects biometric identifiers only through its data breach notification law.

This means businesses operating in South Dakota can collect, store, and use biometric data such as fingerprints, facial recognition templates, and voiceprints without obtaining consent from individuals. Protection only kicks in after a security breach has already occurred.

For a broader overview of privacy protections in the state, see the parent guide to South Dakota Data Privacy Laws.

How South Dakota Law Defines Biometric Data

South Dakota's breach notification statute, SDCL 22-40-19, defines biometric data as data generated from measurements or analysis of human body characteristics for authentication purposes. This definition appears within the broader definition of "personal information" that triggers breach notification requirements.

Under the statute, biometric data is protected when it appears in combination with an identification number assigned to a person by their employer; the statute lists biometric data itself as one of the qualifying secondary elements, alongside a security code, access code, or password, rather than requiring one of those on top of it.

The definition is notably narrow compared to other states. It covers biometric data only when used for authentication purposes. Biometric data collected for other reasons, such as marketing analytics or research, falls outside the statute's scope.

Common types of biometric data that would qualify under this definition include:

• Fingerprint scans used for device or system login
• Facial recognition templates used for identity verification
• Iris scans used for building access
• Voiceprints used for phone authentication
• Hand geometry measurements used for timekeeping systems

Photographs, video recordings, and audio recordings are not explicitly addressed in the biometric data definition under SDCL 22-40-19.

Breach Notification Requirements for Biometric Data

South Dakota's breach notification law, enacted through SB 62 in 2018 and codified at SDCL 22-40-20, establishes the primary legal framework that protects biometric data in the state.

Who Must Comply

Any person or business that conducts business in South Dakota and owns or licenses computerized personal information of South Dakota residents must comply with the breach notification requirements. This applies to both in-state and out-of-state entities.

Notification Timeline

When a breach of system security exposes personal information that includes biometric data, the information holder must notify affected South Dakota residents no later than 60 days from discovery or notification of the breach.

This 60-day window can be extended only if law enforcement determines that notification would impede a criminal investigation. In that case, notification must occur within 30 days after law enforcement clears the delay.

Attorney General Reporting

Any breach affecting more than 250 South Dakota residents must be reported to the South Dakota Attorney General by mail or email. This report must include information about the nature of the breach and the types of personal information compromised.

What Triggers a Notification

A "breach of system security" under the law means the unauthorized acquisition of unencrypted computerized data, or encrypted data along with the encryption key, that materially compromises the security, confidentiality, or integrity of personal or protected information.

If biometric authentication data is exposed in such a breach, the notification obligations apply.

What South Dakota Law Does Not Cover

The gaps in South Dakota's biometric privacy framework are significant. Understanding what the law does not do is just as important as understanding what it does.

No Collection Consent Requirements

South Dakota does not require businesses or employers to obtain consent before collecting biometric identifiers. A company can implement fingerprint scanners, facial recognition cameras, or voice authentication systems without providing notice or obtaining any form of permission from the individuals whose data is collected. The one exception is genetic data handled by consumer DNA testing companies, covered in the next section.

No Retention or Destruction Rules

The law does not set limits on how long organizations can store biometric data. There are no requirements to publish a data retention schedule or to destroy biometric data after a set period or when the purpose for collection has ended.

No Purpose Limitation

Businesses that collect biometric data in South Dakota face no restrictions on how they use it. The law does not prohibit selling, sharing, or repurposing biometric data, so long as no breach notification obligations are triggered.

No BIPA-Style Private Right of Action

South Dakota has no private right of action for biometric data misuse comparable to Illinois's BIPA, which allows individuals to sue for $1,000 to $5,000 per violation. Enforcement of the breach notification statute runs primarily through the Attorney General.

One indirect route exists on paper, but it is unsettled. SDCL 22-40-25 lets the Attorney General prosecute a failure to disclose a breach as a deceptive act or practice under SDCL 37-24-6, and SDCL 37-24-31 permits any person who claims to have been adversely affected by an act or practice declared unlawful by 37-24-6 to bring a civil action for actual damages. Whether a private plaintiff can actually reach a notification failure through that chain has not been settled, and the main deceptive-practice provision in 37-24-6(1) is tied to the sale or advertisement of merchandise. Treat it as an open question, not a dependable remedy.

Civil Penalties for Noncompliance

Under SDCL 22-40-25, the Attorney General may prosecute a failure to disclose as a deceptive act or practice and may bring an action to recover a civil penalty of up to $10,000 per day per violation, in addition to attorney's fees and costs associated with enforcement actions.

Genetic Data: South Dakota's One Consent Statute

South Dakota does regulate one category of body-derived data at the point of collection. SDCL 37-24-59 through 37-24-64 apply to direct-to-consumer genetic testing companies, meaning entities that offer genetic testing products or services directly to consumers or that analyze genetic data collected through such a product.

SDCL 37-24-60 requires those companies to publish a privacy policy and privacy notice in plain language, obtain the consumer's express consent to collect, disclose, or use genetic data, and obtain a separate express consent for each transfer or disclosure to an outside party, for each use beyond the primary purpose of the test, for retaining a biological sample after testing is complete, and for marketing. The statute also requires a security program for genetic data and a process letting the consumer access the data, delete the account and genetic data, and request destruction of the biological sample. Under SDCL 37-24-61, a revocation of consent must be honored within 30 days, and a biological sample must be destroyed within 30 days of a revocation covering it.

SDCL 37-24-63 lets the Attorney General petition a court for a civil penalty of up to $5,000 per violation. SDCL 37-24-64 exempts protected health information held by HIPAA covered entities, samples collected for medical screening, diagnosis, or treatment, higher education institutions, forensic laboratories working with law enforcement, certain research entities, and licensed hospitals.

The scope limit matters: these sections cover DNA and biological samples. They do not reach fingerprints, facial recognition templates, iris scans, or voiceprints, which is why South Dakota still has no general biometric consent requirement.

Federal Laws That May Apply in South Dakota

Because South Dakota lacks comprehensive biometric privacy protections, federal laws provide some additional coverage in specific contexts.

HIPAA

Health care providers, insurers, and their business associates in South Dakota must comply with HIPAA when handling biometric data in a health care context. South Dakota's breach notification law recognizes this by deeming HIPAA-regulated entities in compliance if they follow federal breach notification requirements.

Gramm-Leach-Bliley Act (GLBA)

Financial institutions in South Dakota that collect biometric data for customer authentication must comply with GLBA data security requirements. Similar to HIPAA entities, financial institutions that follow their federal regulator's breach notification requirements are deemed compliant with South Dakota's state law.

Children's Online Privacy Protection Act (COPPA)

Companies collecting biometric data from children under 13 in South Dakota must comply with COPPA requirements, which include obtaining verifiable parental consent before collecting biometric identifiers.

How South Dakota Compares to Neighboring States

South Dakota's approach to biometric privacy is among the least protective in the region.

Iowa enacted a consumer data protection law that classifies biometric data as sensitive, but Iowa Code 715D.4(2) requires only that the consumer be presented with clear notice and an opportunity to opt out before sensitive data is processed. That makes Iowa the outlier among comprehensive privacy states, which generally require opt-in consent. Montana similarly passed comprehensive privacy legislation with biometric data protections.

Nebraska goes further than South Dakota as well. Under the Nebraska Data Privacy Act, Neb. Rev. Stat. 87-1102(30)(b) treats genetic or biometric data processed for the purpose of uniquely identifying an individual as sensitive data, and 87-1112(2)(d) bars a controller from processing sensitive data without obtaining the consumer's consent. Nebraska therefore requires opt-in consent for biometric processing, even though it has no standalone biometric statute.

North Dakota and Wyoming share South Dakota's limited approach, relying primarily on breach notification laws without dedicated biometric privacy statutes.

Minnesota, to the east, has enacted stronger consumer data privacy protections that include biometric data provisions.

Practical Guidance for South Dakota Residents

Without a dedicated biometric privacy law, South Dakota residents have limited legal recourse regarding their biometric data. However, there are practical steps to protect yourself.

Ask employers and businesses what biometric data they collect and how they store it. While they are not legally required to tell you, many organizations have privacy policies that address biometric data.

Review privacy policies before using apps, devices, or services that collect fingerprints, facial scans, or voice data. Federal laws like COPPA and sector-specific regulations may provide some protections depending on the context.

If you use a consumer DNA testing service, read the consent screens carefully. SDCL 37-24-60 entitles you to a separate express consent before your genetic data or sample is transferred, reused, or retained, and SDCL 37-24-61 requires the company to honor a revocation within 30 days.

If you believe your biometric data was compromised in a breach and you did not receive notification, contact the South Dakota Attorney General's Consumer Protection Division to file a complaint.

Legislative Outlook

South Dakota has not enacted a comprehensive consumer data privacy law or a standalone biometric privacy statute. Its only collection-stage privacy duties for body-derived data sit in the genetic testing sections at SDCL 37-24-59 to 37-24-64, which do not reach fingerprints, face scans, or voiceprints.

Given that a growing number of states have enacted comprehensive privacy laws with biometric data provisions, legislative activity in South Dakota remains possible. Any new legislation would be introduced during the state's annual legislative session, which typically runs from January through March.

Residents and businesses should monitor the South Dakota Legislature website for any proposed privacy-related bills.

Sources and References

This article references South Dakota statutes available through the South Dakota Legislature website. For the full text of the breach notification law, see SDCL 22-40-19 through SDCL 22-40-26. For the genetic data provisions, see SDCL 37-24-59 through SDCL 37-24-64. For consumer complaints related to data breaches, contact the South Dakota Attorney General.

This article provides general legal information about South Dakota biometric privacy laws. It is not legal advice. Consult a qualified attorney for guidance on your specific situation. Laws and regulations change frequently. Verify current requirements through official South Dakota government sources.

More South Dakota Laws

• South Dakota Deepfake Laws
• South Dakota Employee Monitoring Laws
• South Dakota GPS Tracking Laws
• South Dakota Recording Laws