Idaho Data Breach Notification Law

The Idaho data breach notification law turns on one investigation

Any person or commercial entity, nonprofits included, that owns or licenses computerized personal information on Idahoans is covered ³. The sequence has three moves:

1. Suspect a breach, then investigate promptly and in good faith.
2. Misuse found, or reasonably likely: residents hear as soon as possible and without unreasonable delay ¹.
3. Misuse unlikely: no letters, and Idaho does not ask for the conclusion in writing or a copy to any office ¹.

The statute builds in time for police requests and for scoping the incident, working out who was affected and bringing systems back ¹.

No state notice, no fixed deadline, and the encryption rule

The 24-hour Attorney General notice in the statute is for city, county and state agencies only ¹. A private company has no agency filing, no day count for its letters and no bureau notice.

So the investigation carries almost all the legal weight. Write down what was reviewed, by whom and on what basis you reached your conclusion, even though no rule demands it; if the Attorney General asks a year later, that file speaks for you. A useful file names the systems involved, the records that were exposed, the logs your IT team pulled and the date each conclusion was reached.

Encrypted records are outside the law, with no carve-back for a stolen key ³. Turning on laptop and backup encryption, an early item in security for a small company, removes many lost-device incidents from the law altogether.

A company following its own security policy with consistent notice timing, or its regulator's breach procedures, is deemed compliant ¹.

Enforcement and the $25,000 fine

The Attorney General is the main enforcer for most companies and can go to court to stop violations. Intentionally withholding a required notice risks a fine of up to $25,000 per breach ². Private suits are not mentioned, which leaves that question unresolved.

When an outside firm holding a client's data has a breach, it must tell and cooperate with that client immediately after discovering it, where misuse has occurred or is reasonably likely ¹. A 2025 bill, S1066, would have added free credit monitoring; it did not pass ⁴.

Practical steps for an Idaho incident

With an intruder still inside, an Idaho company that carries cyber coverage reports the claim first, then submits an IC3 report for the FBI, and copies disks and logs before anything is wiped ⁵⁷⁶. A policy that names a law firm usually means that firm or prior approval; see conditions in a typical cyber policy.

Shutting the door is a job for your managed IT support or a specialist, with the division of labor set out in how incident response works. Idaho's lighter rules end at the border, so record each person's home state: residents of Washington bring a 30-day deadline, and Utah has its own rules. Other states are in the deadline and threshold chart for all states, and Boise firms comparing ongoing support can start with our Boise managed IT page.

Idaho Code 28-51-104 to 28-51-107 was last compared with this page on October 13, 2026. Please read it as background rather than legal advice, and have an Idaho lawyer see the investigation file before anyone decides against letters.