Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Idaho |
|---|---|
| Statute citation | Idaho Code §§ 28-51-104 to 28-51-107 (Commercial Transactions - Identity Theft) (amended |
| Individual notice timing | Most expedient time possible without unreasonable delay Idaho requires businesses to notify affected |
| Attorney general notice | notifications on a public website? |
| Biometric data | No |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | No |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Idaho 'breach of the security of the system' means the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality, or integrity of personal information for one or more persons maintained by an agency, individual or a commercial entity.1 |