South Dakota has come closer to shedding its role as one of only two states without a data breach notification law. And Colorado legislators have introduced a law requiring “reasonable security procedures,” data disposal rules and timely notification of authorities in the event of a breach.