Indiana. Breach notification. Act
IN breach lawIndiana data breach notification law (Ind. Code § 24-4.9 (private); § 4-1-11 (state agencies))
Partly verified
Medium confidence. No verification notes recorded.§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Indiana residents to notify affected individuals after a security breach. Core timing rule: Individuals without unreasonable delay and within 45 days of discovery. Covered data: SSN alone; name plus driver's licence/ID, card numbers, financial account with codes.
- Key themes
- Unique features
AG notice for any notifiable breach; SSN alone triggers notice; breach covers data that could cause identity deception.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Indiana requires the maintaining entity to notify the owner on discovery of a breach. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals without unreasonable delay and within 45 days of discovery; AG whenever individuals notified; CRAs if >1,000
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Up to $150,000 per deceptive act (failure to notify); AG exclusive enforcement
§3Dates
- Key dates
- Adopted
- In force
- HEA 1341 (2022) set 45-day deadline; SB 17 (2024, eff. 2024-07-01) latest amendment
§4Text and authority
- Text
- Authoritative text iga.in.gov
- Authority
- Indiana Attorney General
§5Where it applies
- Domestic law of
- Indiana
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence. No verification notes recorded.