Data Breach Notification Statutes – Indiana
Last Updated: 02/28/2024
- Applicable Statute: Ind. Code § 4-1-11 et seq.; § 24-4.9-1 et seq.
- Attorney General Notice Required: Yes – must notify Attorney General if any resident is notified.
- Timing : Without unreasonable delay, but no later than forty-five (45) days after discovery of the breach.
- Method: May submit breach notification to the Indiana Attorney General’s Office by completing the printable Breach Notification Form and emailing it to DataBreach@atg.in.gov. Must also include sample or copy of the notice going to the affected individuals.
- Content: Form referenced above (https://www.in.gov/attorneygeneral/consumer-protection-division/id-theft-prevention/files/Indiana-Data-Breach-Notification-Form-fillable1.pdf) and sample of notice sent/being sent to affected individuals.
- Consumer Notice Requirements:
- Timing: Without unreasonable delay, but no later than forty-five (45) days after discovery of the breach.
- Method: By mail, telephone, fax, or email if the entity has email addresses of the affected residents.
- Content: Not specified
- Consumer Reporting Agency Requirements: If more than 1,000 residents are notified, must also notify all nationwide consumer reporting agencies, and provide information necessary to assist in fraud prevention, including the personal information of a resident affected by the breach.