Data breach notification
Idaho Code § 28-51-105 sets the duty to disclose a breach of computerized personal information, and § 28-51-104 supplies the definitions.
In Idaho, notice to residents follows an investigation. If the investigation determines that misuse of information about an Idaho resident has occurred or is reasonably likely to occur, the agency, individual or commercial entity shall give notice as soon as possible to the affected resident.
The statute then adds that notice must be made "in the most expedient time possible and without unreasonable delay." No day count is set.
A breach of the security of the system is the illegal acquisition of unencrypted computerized data that materially compromises the security, confidentiality or integrity of personal information.
Personal information is an Idaho resident's first name or first initial and last name with one or more of these, when either the name or the data elements are not encrypted:
Idaho has a fast Attorney General notice, but it is written for agencies: when an agency becomes aware of a breach, it must notify the office of the Idaho attorney general within twenty-four (24) hours of discovery.
That provision applies to city, county and state agencies. No regulator notice for businesses appears in § 28-51-105. A private company reading the section should not mistake the agency rule for its own.
For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.
Watermarks are on by default and set per data room. Recipients confirm their email with a six-digit code and need no account. Because the chained log records each view, upload, download, invitation and change, and exports as CSV, a business can show which confirmed readers opened a file in a room and when. That is the factual groundwork any investigation into a shared room needs.
Checked against Idaho's published law on November 2, 2026. This is general information, not legal advice.
