Law / United States / 
Indiana
Disclosure of Security Breach Act
Ind. Code §§ 24-4.9-3-1, 24-4.9-3-3, 24-4.9-4-1, 24-4.9-4-2
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
Commencement not set.
A breach notification rule binding private bodies.
As of 27 August 2026.
What it requires
- Disclose a breach to affected Indiana residents without unreasonable delay and no later than 45 days after discovering that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud.
- Notify the Indiana Attorney General of any breach disclosure, and notify each nationwide consumer reporting agency if the breach affects more than 1,000 Indiana consumers.
- Expect a failure to disclose, or a failure to implement reasonable safeguards, to be enforced exclusively by the Indiana Attorney General as a deceptive act, never by a private plaintiff.
If you get it wrong
Private right of actionNo
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
A data base owner must disclose a breach of the security of a system to an affected Indiana resident if the owner knows, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting that resident, without unreasonable delay and no later than 45 days after discovering the breach.
A data base owner disclosing to more than 1,000 consumers must also notify nationwide consumer reporting agencies, and any disclosure at all triggers a required notice to the Indiana Attorney General.
Failing to make a required disclosure is a deceptive act actionable only by the Attorney General, with a civil penalty of up to $150,000 per deceptive act, and a separate, narrower duty to implement reasonable safeguards and dispose of records properly carries its own $5,000-per-act penalty, also enforced only by the Attorney General. This is a separate, pre-existing statute from INCDPA. The cited sections were added by P.L.125-2006, Securities and Exchange Commission (SEC).6, and have since been amended piecemeal: Ind.
Code sections 24-4.9-3-1 and 24-4.9-4-1 by P.L.137-2009, and section 24-4.9-3-3 by P.L.171-2022; section 24-4.9-4-2 has not been amended since 2006. Indiana's codified history notes carry only a public-law-and-year citation, with no day-precise commencement date, so no effective date is recorded here.
When LexLint raises it
crawls_webtrains_modelsdeploys_chatbotautomated_outreach
Read the law
official Indiana statute text, Indiana Code Article 4.9, Indiana General Assembly
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.