Privacy Law Library

Disclosure of Security Breach (data breach notification and data security)

IN Breach Notification

Breach notification · Data security

Indiana's breach law requires data base owners to notify affected Indiana residents, and the Attorney General, when a breach of computerized personal information could result in identity theft, identity deception, or fraud. Notice must go out without unreasonable delay and within 45 days of discovery. The article also requires reasonable security procedures and secure disposal of records containing personal information.

Where

Indiana

Citation

Ind. Code art. 24-4.9 (IC 24-4.9-1-1 to 24-4.9-5-1)

Status

In force

In force since

2006-07-01

Last amended

2026-07-01

Enforced by

Indiana Attorney General (actionable only by the AG, IC 24-4.9-4-1, 24-4.9-3-3.5(e))

People can sue

No

Penalties

For failing to notify: injunction, civil penalty up to $150,000 per deceptive act (a related series of breaches counts as one act), and costs (IC 24-4.9-4-2). For failing to keep reasonable security or to dispose of data properly: injunction, up to $5,000 per deceptive act, and costs (IC 24-4.9-3-3.5(f)).

Applies to

• Any person (including nonprofits) that owns or licenses computerized data including personal information of Indiana residents ('data base owner'); persons that maintain such data for others must notify the owner (IC 24-4.9-2-3, 24-4.9-3-2)
• Does not apply to state agencies or the judicial or legislative departments (IC 24-4.9-1-1); state agencies are covered separately by IC 4-1-11
• Personal information: unencrypted and unredacted SSN; name plus driver's license, state ID, credit card, or financial account/debit card number with access code; and, since July 1, 2024, information collected by adult-website operators for age verification under IC 24-4-23 (IC 24-4.9-2-10)