Law / United States / 
Indiana
Disclosure of Security Breach Act, data base owner's duty to maintain reasonable security procedures and dispose of records
In force.
A security baseline statutes rule binding private bodies.
- Obligation class
- Security
What it requires
- This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or Health Insurance Portability and Accountability Act (HIPAA), and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
- Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.NIST CSF 2.0PR.DS-01
- Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.NIST CSF 2.0ID.AM-08
- There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
Civil penalty under Sec. 3.5(f)(2), recoverable only by the Attorney General. The statute's own unit is a 'deceptive act' rather than a bare violation: a failure to comply with the safeguards duty (subsection (c)) or the disposal duty (subsection (d)) in connection with related acts or omissions constitutes one deceptive act under subsection (g). This is separate from, and much lower than, the $150,000-per-deceptive-act penalty at Ind. Code sec. 24-4.9-4-2 for a failure of the article's own breach-notification duty, which is this jurisdiction's privacy-topic row, not this one.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Indiana Attorney General may bring an action under this section to obtain an injunction, a civil penalty of not more than $5,000 per deceptive act, and the Attorney General's reasonable costs of investigation and litigation. A knowing or intentional failure to comply with this section is actionable only by the Attorney General, never by a private plaintiff.
What this law does
A data base owner, a person that owns or licenses computerized data including personal information of an Indiana resident, must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard that personal information from unlawful use or disclosure.
A data base owner must also not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering it illegible or unusable. A data base owner that maintains its own data security procedures under a listed federal privacy or security regime, and complies with that regime's own reasonable-procedures requirement, is exempt.
A current or former health care provider that claimed the Health Insurance Portability and Accountability Act (HIPAA)-based exemption remains bound for personal information, including health records, if its own compliance plan does not require, or is not implemented to provide, that protection once the provider stops being a HIPAA covered entity.
A knowing or intentional failure to comply is a deceptive act, actionable only by the Indiana Attorney General, and a related series of acts or omissions in violation of this section constitutes one deceptive act. No day on which the provisions this entry describes came into force has been located.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .