← All US breach laws·ID

Idaho data breach notification law

Idaho's data breach notification requirements under Idaho Code §§28-51-104 to 28-51-107. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Idaho Code §§28-51-104 to 28-51-107
Enforcer
Idaho Attorney General
AG notification
Not required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
In the most expedient time possible and without unreasonable delay
Notify the state regulator
Only state-agency breaches require AG notice; private businesses are not required to notify the AG
Notify consumer reporting agencies
No specific CRA notification requirement

When is notification required?

Trigger / harm threshold
Notification required only when misuse of PI has occurred or is reasonably likely to occur
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Idaho law

First name/initial + last name with SSN, DL/state ID, financial account + access code

Penalties and enforcement

Up to $25,000 per breach for knowing violations by public agencies; private entities subject to AG enforcement under consumer protection act
Enforced by: Idaho Attorney General. Official regulator page →

Common pitfalls

⚠ No AG-notice requirement is unusual — but Idaho's 'misuse occurred or reasonably likely' standard is fact-specific

Frequently asked questions

How long do I have to notify Idaho residents after a data breach?
In the most expedient time possible and without unreasonable delay
Do I have to notify the Idaho Attorney General?
Only state-agency breaches require AG notice; private businesses are not required to notify the AG
Does Idaho require notification to nationwide consumer reporting agencies?
No specific CRA notification requirement
Is encrypted data exempt from Idaho's breach notification requirement?
Yes — Idaho has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Idaho residents sue me directly for a data breach?
No — Idaho's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Idaho law?
First name/initial + last name with SSN, DL/state ID, financial account + access code
What are the penalties for failing to comply with Idaho's breach notification law?
Up to $25,000 per breach for knowing violations by public agencies; private entities subject to AG enforcement under consumer protection act

Related state breach laws

Georgia (GA)
Ga. Code §§10-1-910 to 10-1-915
Hawaii (HI)
Haw. Rev. Stat. §§487N-1 to 487N-7
Illinois (IL)
815 ILCS 530/1 et seq.
Indiana (IN)
Ind. Code §§24-4.9-1 to 24-4.9-5

Pre-empt the Idaho breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Idaho's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit