Idaho. Breach notification. Act
ID breach lawIdaho data breach notification law (Idaho Code §§ 28-51-104 to 28-51-107)
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Idaho residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account or card numbers with codes.
- Key themes
- Unique features
Fine applies only to intentional failure to notify; narrow PI definition.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Idaho requires the maintaining entity to notify and cooperate with the owner immediately if misuse occurred or is likely. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expedient time possible; state agencies notify AG within 24 hours; no private-sector AG notice
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $25,000 per breach for intentional failure to notify
§3Dates
- Key dates
- Adopted
- In force
- Amended by HB 566 (2010)
§4Text and authority
- Text
- Authoritative text legislature.idaho.gov
- Authority
- Idaho Attorney General
§5Where it applies
- Domestic law of
- Idaho
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.