SDCL § 34-20G-89: Cardholder data maintainable by establishment limited--Authorization to maintain PII.

Except as otherwise provided in this section, information kept or maintained by a medical cannabis establishment may identify a cardholder only by registry identification number and may not contain names or other personally identifiable information.

A cardholder may, in writing, authorize an establishment to maintain the cardholder's name and other personally identifiable information, for the limited purpose of receiving direct communication regarding the cardholder's:

(1) Individual medical needs; or

(2) Use of a specific product.