Law / United States / 
Indiana
Disclosure of Security Breach Act
Ind. Code §§ 24-4.9-3-1, 24-4.9-3-3, 24-4.9-4-1, 24-4.9-4-2
In force.
A breach notification rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Disclose a breach to affected Indiana residents without unreasonable delay and no later than 45 days after discovering the breach, if you know, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting them.
- Notify the Indiana Attorney General of any breach disclosure, and notify each nationwide consumer reporting agency if the breach affects more than 1,000 Indiana consumers.
- Make every disclosure or notification the statute requires, including notice to the Indiana Attorney General, notice to each nationwide consumer reporting agency, and a data holder's notice to the data base owner, without unreasonable delay and no later than 45 days after discovering the breach.
- Expect a failure to disclose, or a failure to implement reasonable safeguards, to be enforced exclusively by the Indiana Attorney General as a deceptive act, never by a private plaintiff.
These lines are LexLint's reading of the law's text. Also read by: Office of the Indiana Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/security-breaches/security-breach-faqs-and-notification-form-for-businesses/
- Guidance body
- Office of the Indiana Attorney General
- Open questions
- Does a delay that is 'necessary to discover the scope of the breach' under Ind. Code § 24-4.9-3-3(a)(2) allow a data base owner to give notice after the 45th day following 'the discovery of the breach'?
What it makes you log
Logging duty
Section 24-4.9-3-1 requires a data base owner to disclose a breach to affected Indiana residents, to consumer reporting agencies where more than 1,000 consumers are notified, and to the Attorney General; section 24-4.9-3-3 sets a 45 day limit with permitted delays; sections 24-4.9-4-1 and 24-4.9-4-2 make a failure to notify a deceptive act actionable only by the Attorney General. The duty is to notify. None of the cited sections requires the owner to document or keep a record of a breach, sets a retention period or gives the Attorney General a right to a record. The hook is the Indiana resident, defined by principal mailing address.
- Kind
- None
- As of
What this law does
A data base owner must disclose a breach of the security of a system to an affected Indiana resident if the owner knows, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting that resident, without unreasonable delay and no later than 45 days after discovering the breach.
A data base owner disclosing to more than 1,000 consumers must also notify nationwide consumer reporting agencies, and any disclosure at all triggers a required notice to the Indiana Attorney General.
Failing to make a required disclosure is a deceptive act actionable only by the Attorney General, with a civil penalty of up to $150,000 per deceptive act, and a separate, narrower duty to implement reasonable safeguards and dispose of records properly carries its own $5,000-per-act penalty, also enforced only by the Attorney General. This is a separate, pre-existing statute from INCDPA. The cited sections were added by P.L.125-2006, Securities and Exchange Commission (SEC).6, and have since been amended piecemeal: Ind.
Code sections 24-4.9-3-1 and 24-4.9-4-1 by P.L.137-2009, and section 24-4.9-3-3 by P.L.171-2022; section 24-4.9-4-2 has not been amended since 2006. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .