Data Breach Notice to Residents and State Authorities in Indiana

At a glance

Requirements one by one

Data and breach trigger

Ind. Code § 24-4.9-2-2 covers unauthorized acquisition of computerized data, including data moved to paper or a similar medium. Its employee good-faith and encrypted portable-device exclusions have separate conditions. Section 24-4.9-2-10 includes an unencrypted or unredacted Social Security number by itself; it also covers a name plus specified ID, card, or account information, and information collected under the adult-oriented website provision.

The data-base owner discloses under § 24-4.9-3-1(a) if it knows, should know, or should have known that the acquisition resulted in or could result in identity deception, theft, or fraud affecting a resident. Encrypted personal information triggers the duty when the acquirer has access to the encryption key.

Recipients and clock

Ind. Code § 24-4.9-2-3 defines the data-base owner as the person that owns or licenses computerized data containing personal information.

The resident is defined in § 24-4.9-2-7 by a principal Indiana mailing address in the owner's records. Under § 24-4.9-3-1(c), an owner making resident disclosure also tells the Attorney General; the statute sets no resident-count threshold for that report. A nonowner maintainer instead notifies the owner when it discovers personal information was or may have been acquired, under § 24-4.9-3-2.

Section 24-4.9-3-3 requires notice without unreasonable delay and no more than 45 days after breach discovery. It allows delay needed to restore system integrity or learn scope, or requested by the Attorney General or law enforcement because disclosure would impede a criminal or civil investigation or jeopardize national security. Notice follows as soon as possible after the need for delay ends.

If more than 1,000 consumers receive disclosure, § 24-4.9-3-1(b) also requires information to each consumer reporting agency to help prevent fraud, including affected Indiana residents' personal information.

Delivery and alternate routes

Section 24-4.9-3-4(a) permits mail, telephone, fax, or email if the owner has the resident's address. It prescribes no content list for the resident message. Substitute notice under subsection (b) requires more than 500,000 affected Indiana residents or a disclosure cost above $250,000. It combines website posting if a site is maintained and major news media serving the affected residents' area. Insufficient contact information alone is not a listed trigger.

An at-least-as-stringent own disclosure policy can avoid a separate notice under § 24-4.9-3-4(c). Subsections (d) and (e) supply specific federal-policy and financial-institution compliance routes.

What trips people up

A Social Security number can stand alone. Section 24-4.9-2-10(1) does not require a name when the exposed item is an unencrypted, unredacted Social Security number.

The Attorney General route has no headcount floor. Section 24-4.9-3-1(c) follows any owner resident disclosure; the more-than-1,000 count belongs to the separate consumer-reporting-agency rule.

Common questions

Is paper data always excluded?

No. Section 24-4.9-2-2 expressly includes computerized data later transferred to paper, microfilm, or a similar medium.

May missing contact details alone justify substitute notice?

Section 24-4.9-3-4(b) lists only the population and cost conditions for its substitute route.

Statutes and sources

• Ind. Code §§ 24-4.9-2-2 to -11 — breach, owner, residence, encryption, and personal-information definitions.
• Ind. Code §§ 24-4.9-3-1 to -4 — recipient, timing, delivery, and alternate-compliance duties.

Current official 2026 text accessed October 14, 2026.