← All US breach laws·IN

Indiana data breach notification law

Indiana's data breach notification requirements under Ind. Code §§24-4.9-1 to 24-4.9-5. Below: the resident-notification deadline, AG/regulator filing threshold, the encryption safe harbor, private right of action exposure, penalty schedule, and the common pitfalls that turn an avoidable incident into a regulator enforcement action.

Statute
Ind. Code §§24-4.9-1 to 24-4.9-5
Enforcer
Indiana Attorney General
AG notification
Required
Private right of action
No (AG-only enforcement)

Notification deadlines

Notify affected residents
Without unreasonable delay
Notify the state regulator
Yes — written notice to the Indiana AG, same time as residents
Notify consumer reporting agencies
Yes — if more than 1,000 residents, notify nationwide CRAs

When is notification required?

Trigger / harm threshold
Notification required if breach has resulted, or could result, in identity deception, theft or fraud
Encryption safe harbor
Yes — properly encrypted personal information is generally exempt from notification, provided the encryption key was not also compromised.

What counts as "personal information" under Indiana law

First name/initial + last name with SSN, DL/state ID, account number/credit/debit + access code; standalone unencrypted SSN is also PI

Penalties and enforcement

Up to $150,000 per deceptive act under the Indiana DTPA
Enforced by: Indiana Attorney General. Official regulator page →

Common pitfalls

⚠ Indiana treats a standalone unencrypted SSN as PI — common in payroll files left on shared drives

Frequently asked questions

How long do I have to notify Indiana residents after a data breach?
Without unreasonable delay
Do I have to notify the Indiana Attorney General?
Yes — written notice to the Indiana AG, same time as residents
Does Indiana require notification to nationwide consumer reporting agencies?
Yes — if more than 1,000 residents, notify nationwide CRAs
Is encrypted data exempt from Indiana's breach notification requirement?
Yes — Indiana has an encryption safe harbor. Breaches of properly encrypted personal information generally do not trigger notification, provided the encryption key was not also compromised.
Can Indiana residents sue me directly for a data breach?
No — Indiana's breach statute does not provide a direct private right of action. Residents typically must rely on the AG to enforce, or pursue common-law negligence claims.
What counts as 'personal information' under Indiana law?
First name/initial + last name with SSN, DL/state ID, account number/credit/debit + access code; standalone unencrypted SSN is also PI
What are the penalties for failing to comply with Indiana's breach notification law?
Up to $150,000 per deceptive act under the Indiana DTPA

Related state breach laws

Idaho (ID)
Idaho Code §§28-51-104 to 28-51-107
Illinois (IL)
815 ILCS 530/1 et seq.
Iowa (IA)
Iowa Code §§715C.1
Kansas (KS)
Kan. Stat. §50-7a02

Pre-empt the Indiana breach notice — audit your policy now

ComplianceIQ runs a free audit of your privacy policy and incident-response language against Indiana's statutory requirements. You'll see every gap before you have to use it for real.

Run free policy audit