Data Breach Notice to Residents and State Authorities in Idaho
At a glance
| Covered entity and service provider | ID business owning/licensing computerized resident PI; nonowner maintainer tells and cooperates with owner/licensee immediately after discovery if misuse occurred or is likely (§ 28-51-105(1),(2)) |
|---|---|
| Breach and covered information | Illegal acquisition of unencrypted computerized PI materially compromising it; name plus SSN, driver/ID, or financial-account access; public-data and good-faith employee exclusions (§ 28-51-104(2),(5)) |
| Risk screen or notice exception | Prompt good-faith investigation; resident and owner notice if misuse occurred or is reasonably likely (§ 28-51-105(1),(2)) |
| Individuals who receive notice | Affected Idaho resident after investigation finds actual or reasonably likely misuse (§ 28-51-105(1)) |
| Individual notice deadline and clock | As soon as possible, most expedient time possible, without unreasonable delay; no fixed outside day count (§ 28-51-105(1)) |
| Regulator threshold and deadline | No general private-entity AG report in §§ 28-51-104 to -106; 24-hour AG rule applies to public agencies only; primary regulators enforce violations (§§ 28-51-105(1), 28-51-104(6)) |
| Consumer-reporting-agency notice | No separate consumer-reporting-agency notice in §§ 28-51-104 to -106 (§§ 28-51-105, 28-51-106) |
| Individual delivery and content | Writing to most recent recorded address, telephone, or qualifying electronic notice; no itemized resident-letter contents in §§ 28-51-104 to -106 (§ 28-51-104(4)) |
| Substitute notice conditions and channels | Cost over $25,000, over 50,000 ID residents, or insufficient contacts: email if available AND website if maintained AND major statewide media (§ 28-51-104(4)(d)) |
| Delays and alternate compliance | Law-enforcement advice that notice impedes criminal investigation permits delay until cleared; timely own-policy or primary-regulator-procedure routes (§§ 28-51-105(3), 28-51-106) |
Requirements one by one
Covered information and misuse investigation
Idaho Code § 28-51-104(2),(5) defines a breach as illegal acquisition of unencrypted computerized personal information that materially compromises its security, confidentiality, or integrity. Covered information is a resident's name with a Social Security number, driver's license or Idaho ID number, or financial-account access data. Lawfully public government or widely distributed media information is excluded. Good-faith employee acquisition for the holder is excluded if it is not used or further disclosed without authorization.
Section 28-51-105(1) requires a prompt, reasonable, good-faith investigation into likely misuse. Resident notice follows if misuse occurred or is reasonably likely.
Resident, owner, and authority notice
A covered owner or licensee must tell an affected Idaho resident as soon as possible, in the most expedient time possible and without unreasonable delay under § 28-51-105(1). The section gives no fixed outside day count. A nonowner maintainer must notify and cooperate with the owner or licensee immediately following discovery under § 28-51-105(2) if misuse occurred or is reasonably likely; cooperation includes sharing relevant breach information.
Sections 28-51-104 to 28-51-106 do not prescribe a separate private-entity Attorney General or nationwide consumer-reporting-agency breach filing. The 24-hour Attorney General command in § 28-51-105(1) expressly applies when an agency discovers a breach; § 28-51-104(6) defines a private holder's primary regulator for enforcement purposes.
Delivery and substitute notice
Section 28-51-104(4) allows written notice to the most recent recorded address, telephone notice, or qualifying electronic notice. Substitute notice is allowed if direct notice would cost over $25,000, more than 50,000 Idaho residents need notice, or contacts are insufficient. It requires email where addresses exist, conspicuous website posting if there is a site, and major statewide media. The cited notice provisions do not itemize resident-letter contents.
What trips people up
The 24-hour rule is a public-agency duty. Section 28-51-105(1) places that deadline on an agency becoming aware of a breach; the private-entity resident deadline remains the as-soon-as-possible standard.
Police delay needs advice from the agency. Section 28-51-105(3) permits delay when law enforcement advises that notice would impede a criminal investigation. Notice resumes as soon as possible without unreasonable delay after the agency advises that the impediment has ended.
Existing procedures have conditions. Under § 28-51-106, a timely own-policy route or qualifying primary-regulator procedures may satisfy the notice duty if the section's conditions are met.
Common questions
Does the investigation itself start a fixed 30-day clock?
No. Section 28-51-105(1) specifies a prompt investigation and notice as soon as possible without unreasonable delay, without a fixed outer day count.
Is access without acquisition enough for a breach under this definition?
Section 28-51-104(2) requires illegal acquisition of the covered computerized data and a material compromise.
Statutes and sources
- Idaho Code § 28-51-104 — definitions, delivery methods, and substitute notice.
- Idaho Code § 28-51-105 — investigation, recipient, timing, and delay.
- Idaho Code § 28-51-106 — policy and regulator-procedure compliance.
Current Idaho Legislature text checked October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Idaho law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Idaho law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace