1. Home
  2. State breach laws
  3. Idaho

Idaho data breach notification law

What Idaho requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Idaho Code §§ 28-51-104 to 28-51-107.

No fixed deadline
Notification deadline
Not required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Idaho sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. There is no Attorney General notice requirement, so Idaho incidents surface mainly through SEC and HHS filings and through other states' records, channels fewer competitors watch. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Idaho breach filings →

Requirements in detail

Statute
Idaho Code §§ 28-51-104 to 28-51-107
Deadline to notify residents
After a prompt good-faith investigation, if misuse of residents' information has occurred or is reasonably likely, notice must go out as soon as possible, in the most expedient time possible and without unreasonable delay. There is no fixed number of days, and law enforcement can request a delay.
Attorney General notification
No for private businesses. City, county, and state agencies must notify the Idaho Attorney General within 24 hours of discovering a breach. The law does not require notice to consumer reporting agencies.
Penalties
The entity's primary regulator may sue to enforce the law and stop further violations. That is the Attorney General for most businesses, the Department of Finance or Department of Insurance for entities they license, or the federal regulator for federally chartered entities. An entity that intentionally fails to give notice faces a fine of up to $25,000 per breach.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Idaho's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Idaho has no law limiting breach lawsuits for organizations that maintain a security program.

Idaho breach notification FAQ

What is the data breach notification deadline in Idaho?

After a prompt good-faith investigation, if misuse of residents' information has occurred or is reasonably likely, notice must go out as soon as possible, in the most expedient time possible and without unreasonable delay. There is no fixed number of days, and law enforcement can request a delay. The governing law is Idaho Code §§ 28-51-104 to 28-51-107.

Does Idaho require notifying the Attorney General of a data breach?

No for private businesses. City, county, and state agencies must notify the Idaho Attorney General within 24 hours of discovering a breach. The law does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Idaho?

The entity's primary regulator may sue to enforce the law and stop further violations. That is the Attorney General for most businesses, the Department of Finance or Department of Insurance for entities they license, or the federal regulator for federally chartered entities. An entity that intentionally fails to give notice faces a fine of up to $25,000 per breach.

Can individuals sue over a data breach in Idaho?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Idaho?

Idaho's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Idaho limit breach lawsuits for companies with a cybersecurity program?

No. Idaho has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Idaho Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →