South Dakota SaaS Agreement Review
South Dakota is a common home for banks and card issuers, yet it has no comprehensive consumer privacy law. What it does have is a breach statute with a hard 60-day deadline and a documented harm exception, plus a sales tax that reaches most services. A Sioux Falls financial firm or a Rapid City tourism business buying software should account for both when pricing and drafting the deal.
Consumer privacy law in South Dakota
No comprehensive state privacy law yet
Data rights in South Dakota
As of October 2026, South Dakota has not enacted a comprehensive consumer privacy law. Federal rules and sector-specific laws still apply, but there is less of a statutory backstop, which means the SaaS contract itself is your main protection. Read the data-use, security, and deletion terms closely, because they carry more weight here.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
How does South Dakota's breach law work?
SDCL 22-40-20 requires an information holder to notify affected South Dakota residents no later than 60 days after discovering or being notified of a breach, unless law enforcement needs justify delay. If more than 250 residents are affected, the attorney general must be notified by mail or email.
There is a narrow exception: notice to residents is not required if, after an appropriate investigation and notice to the attorney general, the business reasonably determines the breach is unlikely to cause harm. That decision must be documented in writing and kept for at least three years. Your SaaS contract should require the vendor to give you the forensic detail you need to make that call.
Is SaaS taxed in South Dakota?
South Dakota taxes most services and products transferred electronically, and the Department of Revenue treats SaaS subscriptions as taxable. Expect the state rate plus any municipal tax on invoices for South Dakota users. If an out-of-state vendor does not collect it, the buyer may owe use tax instead, so check invoices.
Without a state privacy act, nothing requires a data processing agreement. Ask for one, and confirm the vendor will not use your customers' data beyond providing the service or share it with affiliates for marketing.
South Dakota sources checked 2026-10-09: SDCL 22-40-20 · Numeral, SaaS sales tax in South Dakota. Laws change; confirm the current rule before relying on it.
South Dakota SaaS agreement FAQ
Does South Dakota have a data privacy law that affects SaaS contracts?
As of October 2026, South Dakota has not enacted a comprehensive consumer privacy law, so there is less statutory backstop. That makes the SaaS contract itself your main protection, the data-use, security, and deletion terms carry more weight, so read them closely.
Can a SaaS vendor use my South Dakota business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of South Dakota law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in South Dakota?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against South Dakota law in about a minute.
Can a South Dakota business skip breach notices if no harm is likely?
Only after investigating and notifying the attorney general. SDCL 22-40-20 lets a business skip resident notice if it reasonably determines the breach is unlikely to cause harm, but it must document that determination in writing and keep it for at least three years. Your vendor's incident cooperation clause should support that review.
What is the breach deadline in South Dakota?
Sixty days from discovery or notification of the breach, extendable only for legitimate law enforcement needs. If more than 250 South Dakota residents are affected, the attorney general must also be told. Set a much shorter deadline for your SaaS vendor to report incidents to you.
Reviewing a SaaS contract in South Dakota?
Upload it and get the data, liability, and renewal terms checked against South Dakota law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current South Dakota law when you run your agreement, and you should confirm anything critical with a qualified attorney.