Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party cloud storage services that collect personal information in South Dakota? What are the requirements?

Based on the provided context documents, there are no specific requirements or regulations in South Dakota that prohibit the use of third-party cloud storage services that collect personal information. However, there are regulations that govern the disclosure of nonpublic personal financial information to nonaffiliated third parties [SDAR 20:06:45:10][1.2] and the disclosure of nonpublic personal health information [SDAR 20:06:45:27][1.4].

Disclosure of Nonpublic Personal Financial Information

If a licensee provides nonpublic personal financial information to a nonaffiliated third party to perform services for the licensee or functions on the licensee’s behalf, the opt-out requirements do not apply if the licensee provides the initial notice in accordance with § 20:06:45:04 and enters into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information [SDAR 20:06:45:13][1.2].

Disclosure of Nonpublic Personal Health Information

A licensee may not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose nonpublic personal health information is sought to be disclosed [SDAR 20:06:45:27][1.4].

Therefore, if a third-party cloud storage service is used to store nonpublic personal financial information or nonpublic personal health information, the licensee must ensure that the service provider enters into a contractual agreement that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information. Additionally, the licensee must obtain authorization from the consumer or customer whose nonpublic personal health information is sought to be disclosed.

It is important to note that the provided context documents do not cover all possible regulations and requirements that may apply to the use of third-party cloud storage services that collect personal information. Therefore, it is recommended to consult with legal counsel to ensure compliance with all applicable regulations and requirements.

[SDAR 20:06:45:10][1.2][SDAR 20:06:45:27][1.4]

Source(s):
Jurisdiction

South Dakota