Indiana Data Breach Notification Law: Deadline, Notice, and Penalties

Indiana’s data breach notification law requires any business or organization that owns a computerized database containing personal information about Indiana residents to notify those residents, and the Indiana Attorney General, within 45 days of discovering a breach. The rules are codified at Indiana Code 24-4.9. A failure to comply is treated as a deceptive act, and the Attorney General can seek civil penalties of up to $150,000 per violation.

Who Has to Give Notice

The statute splits responsibility between two kinds of entities.

A database owner is any person or organization that owns or licenses computerized data containing personal information of Indiana residents. The owner carries the full notification burden: affected individuals, the Attorney General, and, when the breach is large enough, the national consumer reporting agencies.¹

A data maintainer stores personal information but does not own it. Cloud hosts and payroll processors are typical examples. If a maintainer discovers a breach, its job is to alert the database owner promptly so the owner can handle disclosure.

What Counts as Personal Information

The notification duty only kicks in when the exposed data meets the statutory definition of personal information, and only when that data is not encrypted or redacted. Indiana covers:

A Social Security number by itself. Unlike many states, Indiana treats an SSN as personal information even without an accompanying name.
A first and last name (or first initial and last name) combined with a driver’s license number, state ID number, credit card number, or a financial account or debit card number paired with its security code, password, or access code.
Information collected under Indiana’s adult-website age verification law at IC 24-4-23, added by a 2024 amendment.

Publicly available information and data from government records lawfully open to the public are excluded.²

Encryption does heavy lifting here. Because the personal information definition excludes encrypted or redacted data, a breach of properly encrypted records does not meet the statutory trigger. The breach definition itself also carves out encrypted information on portable electronic devices, as long as the encryption key was not compromised or in the hands of the unauthorized person.³ If both the data and the key are taken together, that safe harbor disappears.

When a Breach Triggers the Duty

A breach is the unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information.³

A database owner has to disclose when unencrypted personal information was, or may have been, acquired by an unauthorized person, and the owner knows or should know the breach has resulted in or could result in identity theft, identity deception, or fraud. There is no minimum headcount. Even a single compromised record can trigger the full notification process.¹

The 45-Day Deadline

Notice has to go out “without unreasonable delay” and no later than 45 days after the breach is discovered. The 45-day figure is a statutory ceiling, not a target. If you can notify sooner, the statute expects you to.⁴

Only three reasons justify going past the normal timeline:

You need additional time to restore the integrity of the computer system.
You need to determine the scope of the breach.
The Attorney General or a law enforcement agency asks you to wait because disclosure would impede a criminal or civil investigation or jeopardize national security.

Once the reason for the delay no longer applies, notice has to go out as soon as possible. For a law enforcement hold, the clock restarts when the agency says disclosure is safe.⁴

How to Notify Residents

You can use any one of four standard methods: mail, telephone, fax, or email (if you have the resident’s email address on file). Any one of these satisfies the statute.⁵

Substitute Notice for Large Breaches

When direct notice is impractical, substitute notice is allowed. You qualify if either:

The breach affects more than 500,000 Indiana residents, or
The estimated cost of direct notice exceeds $250,000.

Substitute notice requires two steps together: a conspicuous notice posted on the company’s website and notice to major news media in the geographic area where affected residents live. Using one without the other does not satisfy the requirement.⁵

Compliance Through Your Own Policy

A database owner that already maintains an information privacy or security policy with breach disclosure procedures at least as stringent as the statute’s does not need to follow the specific statutory steps separately, provided it actually follows its own policy.⁵

Reporting to the Attorney General and Credit Bureaus

Every notifiable breach has to be reported to the Indiana Attorney General, regardless of how many residents are affected. There is no 500-resident threshold or any similar floor. If even one Indiana resident’s data is compromised and notice is required, the AG has to be told.¹

The Attorney General’s office accepts breach reports by email. Database owners complete the Indiana Data Breach Notification Form and send it, along with a copy or sample of the notice sent to affected individuals, to DataBreach@atg.in.gov.

When a breach affects more than 1,000 consumers, the database owner also has to notify each nationwide consumer reporting agency with information needed to help prevent fraud. In practice, that means Equifax, Experian, and TransUnion.¹

Penalties for Failing to Notify

A database owner that fails to comply commits a deceptive act under Indiana law. That classification matters because it gives the Attorney General specific enforcement tools, and only the Attorney General can bring an action.⁶

The AG can seek:

An injunction requiring the business to comply going forward.
A civil penalty of up to $150,000 per deceptive act.
Reasonable costs of investigation and litigation.

A failure to notify in connection with a related series of breaches counts as a single deceptive act, so the $150,000 cap applies to the whole episode rather than to each individual incident within it.⁷⁶

No Private Lawsuit Under the Statute

Affected individuals cannot sue a company under IC 24-4.9 for failing to notify them. Enforcement is reserved to the Attorney General.⁶ Common law claims like negligence or breach of contract remain available in state court, but they arise outside this statute.

Exemptions for Federally Regulated Entities

If a database owner already follows breach disclosure procedures under certain federal frameworks, and those procedures require Indiana residents to be notified without unreasonable delay, the owner is exempt from the separate state requirements. The qualifying federal regimes are:⁵

HIPAA, for covered entities and business associates handling protected health information.
The Gramm-Leach-Bliley Act, for financial institutions subject to federal privacy and safeguard rules.
The Fair Credit Reporting Act, for consumer reporting agencies and furnishers.
The USA PATRIOT Act and Executive Order 13224.
The Driver’s Privacy Protection Act, for entities handling motor vehicle records.

Financial institutions that comply with the Federal Interagency Guidance on Response Programs for Unauthorized Access to Customer Information also qualify. The exemption is not automatic. The entity’s policy must actually require notice to Indiana residents without unreasonable delay, and the entity has to follow it. Being subject to HIPAA or GLBA on paper is not enough if the internal procedures fall short.⁵

1
Indiana General Assembly. Indiana Code 24-4.9-3-1 – Disclosure of Breach
2
Indiana General Assembly. Indiana Code 24-4.9-2-10 – Personal Information
3
Indiana General Assembly. Indiana Code 24-4.9-2-2 – Breach of the Security of Data
4
Indiana General Assembly. Indiana Code 24-4.9-3-3 – Delay of Disclosure or Notification
5
Indiana General Assembly. Indiana Code 24-4.9-3-4 – Method of Disclosure; Exceptions
6
Indiana General Assembly. Indiana Code 24-4.9-4-1 – Failure to Disclose or Notify; Deceptive Act
7
Indiana General Assembly. Indiana Code 24-4.9-4-2 – Action by Attorney General