Duty LXD-6169
Operates a social platform, in Indiana
Each law's tag says when it binds: in force in force from , in 7 weeks not yet in force
Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of recordsin force4 lines
Ind. Code sec. 24-4.9-3-3.5 · Read the law's page
- This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA, and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
- Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.
- Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.
- There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.
Persons holding a customer's personal information, disposal of personal informationin force3 lines
Ind. Code secs. 24-4-14-1 to 24-4-14-8 · Read the law's page
- This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
- Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
- Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.
HEA 1408 (2026), social media accounts held by minorsfrom , in 7 weeks3 lines
House Enrolled Act No. 1408 (2026), Public Law 100-2026, adding Ind. Code art. 24-16 and amending Ind. Code sec. 24-5-0.5-3 · Read the law's page
- Determine whether a user is an Indiana resident under 16.
- Obtain verifiable parental consent before creating an account for such a user.
- Configure the account of a user you know or have reason to know is an Indiana resident under 16 so that it cannot receive direct communications except from a linked account, cannot appear in search results except to a linked account, and cannot be shown content, recommendations, or advertising based on the user's patterns of use or the addictive features.