The last two states which have not passed data breach notification laws are Alabama and South Dakota. Sometimes we make jokes about these states as they are so late to the data breach notification table (California was the first state to pass a data breach notification law in 2002) and they seem not to care about consumer protection.

Not so anymore. Both Alabama and South Dakota are considering passing data breach notification laws. South Dakota Senate Bill 62 was approved by the Senate in late January by a vote of 30-2. The bill is winding its way to the House of Representatives.

Not to be left behind as the last one standing, Alabama’s breach notification law (Senate Bill 318) was passed unanimously by the Alabama Senate last week and is now heading to the Alabama House of Representatives. The Alabama bill would require companies to implement and maintain reasonable security measures to protect sensitive personal information, including performing a risk assessment.

It’s now a race to be dubbed the 50^th, (or last) state to pass a data breach notification law— a mere 16 year delay. Better late than never.