Idaho Cybersecurity Laws You Should Know (2026)

Last Updated: August 28, 2026

Idaho cybersecurity laws require businesses to protect personal information, notify individuals after qualifying data breaches, and comply with industry-specific cybersecurity and privacy requirements. While Idaho has not enacted a comprehensive consumer privacy law similar to California or Oregon, organizations that collect personal information belonging to Idaho residents must still comply with the state’s data breach notification requirements and maintain reasonable security practices.

Whether your business operates in Idaho or simply stores personal information belonging to Idaho residents, understanding these laws can help reduce regulatory risk while strengthening your overall cybersecurity program.

This guide explains the major Idaho cybersecurity laws businesses should understand in 2026 and outlines practical steps organizations can take to improve compliance.

Idaho Cybersecurity Laws at a Glance

Requirement	Summary
Primary Breach Law	Idaho Personal Information Protection Act (Idaho Code §§ 28-51-101 through 28-51-107)
Comprehensive Consumer Privacy Law	None currently in effect
Primary Regulator	Idaho Attorney General
Consumer Notification	In the most expedient time possible and without unreasonable delay
Attorney General Notification	Required for Idaho public agencies within 24 hours of discovering a breach. Commercial businesses may voluntarily notify the Idaho Attorney General.
Consumer Reporting Agencies	Required when more than 1,000 residents are notified

Who Should Read This Guide?

This guide is especially useful for:

• Manufacturers
• Construction companies
• Healthcare organizations
• Agricultural businesses
• Financial institutions
• Technology companies
• Professional service firms
• Government contractors
• Retail businesses
• Any organization maintaining personal information belonging to Idaho residents

What Makes Idaho Cybersecurity Laws Different?

Unlike states that have enacted comprehensive consumer privacy laws, Idaho focuses primarily on:

• Protecting personal information through reasonable security practices
• Responding appropriately to security breaches
• Providing timely notification to affected consumers
• Industry-specific cybersecurity regulation

Organizations should understand that Idaho law centers on safeguarding personal information and responding effectively to incidents rather than regulating every aspect of personal data collection and processing.

Idaho Personal Information Protection Act

Idaho’s primary cybersecurity law is the Personal Information Protection Act, codified in Idaho Code §§ 28-51-101 through 28-51-107.

The law applies to businesses, government agencies, and other organizations that own or license computerized personal information belonging to Idaho residents.

Its purpose is to reduce identity theft and financial fraud by requiring organizations to notify affected individuals following qualifying security breaches.

Idaho Data Breach Notification Requirements

If a security breach involving personal information occurs, covered organizations generally must notify affected Idaho residents in the most expedient time possible and without unreasonable delay after discovering the breach.

Organizations may delay notification when necessary to:

• Determine the scope of the breach
• Restore the integrity of affected systems
• Comply with a law enforcement request delaying notification

Unlike some states, Idaho does not establish a fixed number of days for notification.

Instead, organizations are expected to act promptly based on the facts surrounding the incident.

Having a documented incident response plan allows organizations to quickly determine:

• What systems were compromised
• What information was affected
• Whether unauthorized acquisition occurred
• Which Idaho residents were impacted
• Whether Attorney General notification is required
• Whether federal notification obligations also apply

Idaho Attorney General Notification Requirements

Idaho’s reporting requirements differ depending on the type of organization involved.

Under Idaho Code § 28-51-105, Idaho public agencies must notify the Idaho Attorney General within 24 hours after discovering a breach of their security system.

Commercial businesses are not generally required under Idaho’s Personal Information Protection Act to notify the Attorney General following a data breach. However, businesses may voluntarily notify the Attorney General’s Consumer Protection Division and should determine whether any federal laws, contractual obligations, insurance requirements, or industry regulations require additional reporting.

Organizations should incorporate these distinctions into their incident response procedures.

Consumer Reporting Agency Notification

When more than 1,000 Idaho residents receive breach notifications, organizations generally must also notify nationwide consumer reporting agencies.

These notifications help consumer reporting agencies prepare for potential increases in fraud and identity theft following significant breaches.

What Information Is Protected?

Idaho defines personal information broadly.

Protected information generally includes an individual’s first name or first initial and last name combined with one or more of the following:

• Social Security number
• Driver’s license number
• State identification card number
• Financial account number
• Credit card number
• Debit card number
• Security code
• Password permitting access to a financial account

Organizations should maintain an inventory of systems storing this information so they can quickly determine whether notification obligations have been triggered following a cybersecurity incident.

Reasonable Security Practices

Although Idaho does not require businesses to maintain a Written Information Security Program (WISP), organizations should implement reasonable administrative, technical, and physical safeguards appropriate for protecting personal information.

Recommended practices include:

• Conducting cybersecurity risk assessments
• Encrypting sensitive information where appropriate
• Implementing multi-factor authentication
• Restricting access to personal information
• Maintaining endpoint detection and response
• Reviewing third-party vendor security
• Developing incident response procedures
• Providing employee cybersecurity awareness training

These controls reduce cyber risk while supporting compliance with Idaho’s breach notification requirements.

Idaho’s Growing Critical Infrastructure Sector

Idaho’s economy includes growing manufacturing, food processing, agriculture, energy, and technology industries.

Organizations supporting these sectors often maintain operational technology (OT), industrial control systems (ICS), and critical infrastructure that require additional cybersecurity planning.

Businesses should consider:

• Network segmentation
• Offline backups
• Vendor access controls
• Business continuity planning
• Disaster recovery testing
• Continuous monitoring

Many organizations also rely on guidance from the Cybersecurity and Infrastructure Security Agency (CISA) to strengthen cybersecurity programs supporting critical infrastructure.

Idaho Insurance Cybersecurity Requirements

Insurance companies and insurance professionals operating in Idaho should evaluate both Idaho’s general data breach requirements and any federal, contractual, or regulatory cybersecurity obligations that apply to their operations.

Idaho considered a dedicated Insurance Data Security Act through House Bill 117 in 2025, which would have created new cybersecurity and breach-reporting obligations for larger insurance organizations. However, the bill did not become law.

The Idaho Department of Insurance had proposed the legislation as a way to establish insurance-industry standards for protecting personal information and reporting cybersecurity incidents, but HB 117 did not advance to enactment.

Official resource: Idaho Department of Insurance

Insurance organizations should nevertheless maintain strong cybersecurity controls because they may still be subject to:

• Idaho’s general breach notification requirements
• Federal privacy and security laws
• Contractual cybersecurity requirements
• NAIC-related regulatory expectations
• Cyber insurance requirements
• Vendor security obligations

Recommended practices include maintaining written cybersecurity policies, conducting risk assessments, monitoring systems for suspicious activity, protecting policyholder information, reviewing third-party vendors, and maintaining an incident response plan.

Idaho Attorney General Breach Reporting Requirements

Idaho’s breach reporting rules differ significantly between public agencies and commercial businesses.

According to the Idaho Office of the Attorney General, an Idaho public agency must notify the Attorney General’s Office within 24 hours of discovering a breach of its security system under Idaho Code § 28-51-105(1).

Commercial entities are not subject to the same mandatory Attorney General reporting requirement under Idaho’s general breach law. They may voluntarily provide notification to the Attorney General’s Consumer Protection Division.

Official resource: Idaho Attorney General Security Breach Guidance

This distinction is important for businesses developing incident response plans.

A commercial business should not assume that Idaho imposes the same Attorney General reporting threshold found in states such as Oregon or Washington.

Organizations should still evaluate whether another regulator, federal law, contract, insurance policy, or industry requirement creates additional reporting obligations.

Federal Cybersecurity Laws That May Apply in Idaho

Idaho cybersecurity law represents only one part of an organization’s compliance responsibilities.

Depending on the organization’s industry, information maintained, and customers served, businesses may also be subject to federal cybersecurity and privacy laws.

Health Insurance Portability and Accountability Act (HIPAA)

Healthcare providers, health plans, healthcare clearinghouses, and qualifying business associates may be subject to HIPAA when handling protected health information.

Official resource: U.S. Department of Health and Human Services HIPAA Resources

HIPAA generally requires covered organizations to implement administrative, physical, and technical safeguards.

Important cybersecurity practices include:

• Security risk assessments
• Access controls
• Workforce cybersecurity training
• Authentication
• Audit logging
• Incident response procedures
• Business associate agreements
• Backup and recovery planning

An Idaho healthcare organization experiencing a breach may therefore need to evaluate both HIPAA and Idaho’s Personal Information Protection Act.

Gramm-Leach-Bliley Act (GLBA)

Banks, lenders, mortgage companies, investment firms, and other qualifying financial institutions may be subject to the Gramm-Leach-Bliley Act and the FTC Safeguards Rule.

Official resource: FTC Gramm-Leach-Bliley Act Guidance

Covered financial institutions may need to:

• Develop a written information security program
• Conduct cybersecurity risk assessments
• Implement access controls
• Encrypt sensitive information
• Monitor systems
• Review service providers
• Train employees
• Maintain incident response procedures

Financial institutions should evaluate both federal GLBA obligations and Idaho-specific breach notification requirements.

Federal Trade Commission Act

The Federal Trade Commission can pursue organizations engaging in unfair or deceptive privacy and cybersecurity practices.

Official resource: Federal Trade Commission

Businesses should ensure statements made in:

• Privacy policies
• Contracts
• Marketing materials
• Security documentation
• Customer communications

accurately reflect their actual cybersecurity practices.

An organization claiming that customer data is encrypted or continuously monitored should ensure those safeguards are actually implemented.

Family Educational Rights and Privacy Act (FERPA)

Schools, colleges, universities, and certain education-related organizations may also be subject to the Family Educational Rights and Privacy Act.

Official resource: U.S. Department of Education Student Privacy

FERPA regulates access to and disclosure of student educational records.

Educational institutions should evaluate both privacy obligations and technical controls protecting student information.

DFARS and NIST SP 800-171

Idaho manufacturers, technology companies, and contractors working with the federal government or Department of Defense may face additional contractual cybersecurity requirements.

Organizations handling Controlled Unclassified Information (CUI) may need to comply with DFARS requirements and NIST SP 800-171.

Official resource: NIST SP 800-171

These requirements may involve:

• Multi-factor authentication
• Access control
• Configuration management
• Logging
• Security assessments
• Incident reporting
• System monitoring
• Protection of controlled information

Federal contractors should review their actual contracts rather than assuming compliance with Idaho state law satisfies federal cybersecurity requirements.

NIST Cybersecurity Framework

Many Idaho businesses use the NIST Cybersecurity Framework (CSF 2.0) to organize cybersecurity risk management.

Official resource: NIST Cybersecurity Framework

The Framework is structured around six core functions:

• Govern
• Identify
• Protect
• Detect
• Respond
• Recover

Using a recognized cybersecurity framework can help organizations:

• Identify security gaps
• Prioritize investments
• Document cybersecurity policies
• Improve incident response
• Strengthen vendor oversight
• Demonstrate a structured approach to cybersecurity risk

Even when Idaho law does not prescribe a specific framework, NIST can provide a practical foundation for implementing reasonable cybersecurity practices.

Idaho Cybersecurity Compliance Checklist

Organizations collecting or maintaining personal information belonging to Idaho residents should regularly evaluate their cybersecurity program.

Consider the following steps:

• Inventory systems containing personal information.
• Identify information covered under Idaho Code Title 28, Chapter 51.
• Classify sensitive information according to risk.
• Restrict access based on job responsibilities.
• Require multi-factor authentication for critical systems.
• Encrypt sensitive information where appropriate.
• Maintain endpoint detection and response.
• Monitor networks for suspicious activity.
• Patch operating systems and applications promptly.
• Conduct periodic cybersecurity risk assessments.
• Review third-party vendor security practices.
• Include breach notification obligations in vendor agreements.
• Maintain tested backups.
• Develop and test an incident response plan.
• Train employees on phishing and social engineering.
• Document breach investigations.
• Determine whether federal notification requirements apply.
• Review whether the organization is a public agency subject to Idaho’s 24-hour Attorney General notification requirement.
• Review cybersecurity requirements annually.

Cybersecurity compliance should be treated as an ongoing process rather than a one-time project.

Example: An Idaho Manufacturer Experiences Ransomware

Consider an Idaho manufacturing company that discovers ransomware spreading across several corporate servers.

Attackers obtained employee credentials through a phishing email and accessed systems containing:

• Employee Social Security numbers
• Payroll information
• Customer financial information
• Vendor records
• Online account credentials

The organization activates its incident response plan and begins determining:

1. What information was accessed?
2. Does the incident meet Idaho’s definition of a security breach?
3. Which Idaho residents were affected?
4. Was protected information encrypted?
5. When did the organization discover the breach?
6. Are consumer notifications required?
7. Did a third-party vendor contribute to the incident?
8. Are HIPAA, GLBA, DFARS, contractual, or insurance requirements also triggered?

Idaho generally requires qualifying businesses to provide consumer notification in the most expedient time possible and without unreasonable delay.

Because the manufacturer is a commercial entity rather than an Idaho public agency, Idaho’s general law does not automatically require it to notify the Attorney General. The Idaho Attorney General expressly states that commercial entities may provide notification voluntarily.

The company may still face reporting requirements under another applicable law, contract, insurance policy, or regulatory framework.

Frequently Asked Questions About Idaho Cybersecurity Laws

What is Idaho’s primary cybersecurity law?

The Idaho Personal Information Protection Act, located in Idaho Code Title 28, Chapter 51, establishes Idaho’s primary data breach notification requirements.

Does Idaho have a comprehensive consumer privacy law?

No.

As of August 2026, Idaho has not enacted a broad comprehensive consumer privacy law comparable to those in California, Oregon, Colorado, or several other states.

How quickly must Idaho businesses notify consumers after a breach?

Covered organizations generally must provide notification in the most expedient time possible and without unreasonable delay following discovery of a qualifying breach.

Idaho does not impose one universal 30-day or 45-day deadline.

Do businesses have to notify the Idaho Attorney General after a breach?

Not generally under Idaho’s general breach statute.

The Idaho Attorney General states that commercial entities may notify the Attorney General’s Office but are not required to do so under Title 28, Chapter 51.

Do Idaho public agencies have to notify the Attorney General?

Yes.

Idaho Code § 28-51-105(1) requires an Idaho public agency to notify the Attorney General’s Office within 24 hours of discovering a breach of its security system.

Did Idaho enact an Insurance Data Security Act?

No.

House Bill 117 was proposed during the 2025 legislative session and would have created an Insurance Data Security Act, but the legislation did not pass.

Does Idaho require businesses to maintain a Written Information Security Program?

Idaho does not currently impose a universal WISP requirement comparable to Massachusetts.

Businesses should still maintain written cybersecurity policies, risk assessments, access controls, incident response plans, and other reasonable safeguards.

Does ransomware automatically trigger Idaho’s breach notification law?

Not necessarily.

Organizations should investigate whether protected personal information was illegally acquired and whether the incident meets Idaho’s statutory definition of a security breach before determining notification obligations.

Does Idaho have a specific cybersecurity framework business must follow?

Not generally.

Many organizations voluntarily align their security programs with recognized standards such as the NIST Cybersecurity Framework.

Are Idaho healthcare businesses subject to additional cybersecurity requirements?

Potentially.

Healthcare providers and business associates may be subject to HIPAA in addition to Idaho’s state breach notification law.

Are Idaho financial institutions subject to additional requirements?

Potentially.

Qualifying financial institutions may be subject to GLBA and the FTC Safeguards Rule in addition to applicable Idaho requirements.

Does complying with Idaho law satisfy federal cybersecurity requirements?

No.

Organizations may also need to comply with HIPAA, GLBA, FERPA, DFARS, NIST SP 800-171, contractual cybersecurity requirements, PCI DSS, or other industry-specific standards.

Compare Cybersecurity Laws in Neighboring States

Organizations operating throughout the western United States may need to comply with several different privacy and cybersecurity frameworks.

State	Comprehensive Privacy Law	General Breach Deadline
Idaho	No	Without unreasonable delay
Oregon	Yes	Generally 45 days
Washington	No broad comprehensive law, but My Health My Data applies	Generally 30 days
Nevada	Limited framework plus consumer health privacy law	Without unreasonable delay
Utah	Yes	Without unreasonable delay
Montana	Yes	Without unreasonable delay

Businesses operating across multiple states should analyze each jurisdiction separately because definitions of personal information, consumer rights, regulator notification requirements, and breach deadlines vary significantly.

Related Cybersecurity Guides

Continue learning about cybersecurity compliance by exploring:

• Oregon Cybersecurity Laws
• Washington Cybersecurity Laws
• Nevada Cybersecurity Laws
• Utah Cybersecurity Laws
• Montana Cybersecurity Laws

Conclusion

Idaho’s cybersecurity framework remains focused primarily on protecting personal information and responding quickly when security breaches occur. The Idaho Personal Information Protection Act establishes the state’s central breach notification requirements, while federal, contractual, and industry-specific rules may create additional cybersecurity responsibilities for healthcare providers, financial institutions, government contractors, manufacturers, and other organizations.

Businesses should also understand an important distinction in Idaho’s breach reporting rules. Public agencies must notify the Idaho Attorney General within 24 hours of discovering a security breach, while commercial businesses are not subject to the same mandatory Attorney General notification requirement under Idaho’s general breach law.

Although Idaho has not enacted a comprehensive consumer privacy law or the proposed Insurance Data Security Act, organizations should not interpret that as a reason to minimize cybersecurity investment. Regular risk assessments, multi-factor authentication, employee training, vendor management, incident response planning, secure backups, and continuous monitoring can reduce both regulatory and operational risk.

Businesses that proactively strengthen these areas are better positioned to protect personal information, respond effectively to cybersecurity incidents, satisfy applicable Idaho and federal requirements, and maintain customer trust.

Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel regarding the application of Idaho cybersecurity and privacy laws to their specific circumstances.