9.2. SA Federal Data Breach Notification Act

Corporations or government entities are required to report data breaches involving personal data (e.g., employee names, financial records) within 72 hours of discovery.

Penalty: Fines up to $20 million and criminal penalties for owners found negligent in protecting personal data.