Indiana Data Breach Notification Law

The Indiana data breach notification law: who it covers and how fast

Indiana's breach law, Indiana Code article 24-4.9, applies to "database owners": businesses that own or license computerized data containing Indiana residents' personal information ¹. It also covers that computer data after it has been printed or moved to other media ². Once a breach is discovered, the owner has 45 days at most to notify residents, and the Attorney General must hear about it within the same window ¹.

Two points make Indiana stricter than it first looks. The Attorney General notice has no threshold: one affected resident is enough. And the grounds for delaying notice are short and specific.

The 45-day clock and the limited reasons to delay

The 45 days run from discovery of the breach, not from the end of your investigation ¹. Notice must also be given without unreasonable delay, so finishing on day 44 needs a reason.

Indiana allows delay for only three purposes ¹:

• To restore the integrity of the computer system
• To find the scope of the breach
• At the request of the Attorney General or a law enforcement agency

The 45-day limit applies to every disclosure under the chapter, including the Attorney General notice ¹. If the breach also touches residents of Illinois or Ohio, their rules run in parallel, and our state breach law table shows each one.

When a breach must be reported, and what counts

Notice is required when the database owner knows, should know or should have known that the breach has resulted in, or could result in, identity deception, identity theft or fraud affecting an Indiana resident ². That is a harm test, but a demanding one: "could result in" sets a low bar, and "should have known" judges you by what a careful business would have found.

Indiana's definition of personal information has some unusual edges ²:

• A Social Security number alone, even without a name
• A credit card number with a name, even without the security code
• Age verification information collected by operators of adult websites, added by Senate Enrolled Act 17, effective July 1, 2024 ⁴

Encrypted or redacted data is exempt unless the key was also acquired ². A lost or stolen laptop or phone is not a breach at all if everything on it is encrypted and the key is secure ². That rule makes device encryption one of the most valuable cybersecurity steps for a small business in Indiana.

Who enforces it, and the $150,000 penalty

Only the Attorney General can pursue a violation ³. Failing to comply is a deceptive act, and the Attorney General may seek an injunction and a civil penalty of up to $150,000 per deceptive act ³. There is no private right of action.

Vendors are a gap to close by contract. A company that keeps data for a database owner must notify the owner if personal information was or may have been acquired, but the statute sets no deadline for that ². Put a short one in your IT and software contracts so your own 45 days do not disappear while a vendor investigates.

Indiana's new privacy law and other rules

The Indiana Consumer Data Protection Act took effect January 1, 2026. It applies to businesses that control or process personal data of at least 100,000 Indiana consumers a year, or at least 25,000 while earning more than half their gross revenue from selling personal data ⁵. Most small firms fall below those lines, but the breach law has no such floor.

Health care practices also answer to the HIPAA breach notification rule, and non-bank financial firms to the FTC Safeguards Rule and its written information security plan requirement.

Using Indiana's 45 days well

Should the attack still be running, an insured Indiana business calls its carrier first, files a report at ic3.gov, and keeps every affected system as it is, with nothing wiped or rebuilt, until evidence is preserved ⁷⁹⁸. The carrier may choose the lawyers, so ask before you hire; typical conditions in cyber policies are covered separately.

Work from our breach response checklist while your IT support or a forensic firm contains the incident. Meanwhile, group affected people by state, mark day 45 from discovery, and write the Attorney General notice alongside the resident letters. Hoosiers lodged 20,777 complaints with IC3 in 2025, reporting about $233 million in losses ⁶. Managed IT in Indianapolis covers what local support costs.

Indiana Code article 24-4.9 was compared with this summary on October 13, 2026. Because this is general information and not legal advice, have counsel confirm your obligations well before day 45.