A Data Breach
IC 24-4.9-3-3 — notice without unreasonable delay, and not more than 45 days after discovery
A data base owner that discovers a breach discloses it to each Indiana resident whose unencrypted personal information, or encrypted information along with the key, was or may have been acquired, where the owner knows or should know it has resulted or could result in identity deception, identity theft or fraud. The owner also tells the attorney general.
Who handles this in Indiana: Indiana Attorney General, Consumer Protection Division; and legal aid programs and the state offices, listed in the Indiana directory.
Notice goes out without unreasonable delay, and not more than 45 days after discovery. A delay is reasonable only to restore the system, find the breach's scope, or at the request of the attorney general or police because notice would impede an investigation or jeopardize national security.
Where a breach requires notice to more than one thousand consumers, the owner also gives the consumer reporting agencies the information they need to help prevent fraud.
Sources for this section (2)
- IC 24-4.9-3-1 — Disclosure of breach
- IC 24-4.9-3-3 — Delay of disclosure or notification
Legal information, not legal advice. Verified as of October 2026. Applying it to a particular situation is the work of a licensed Indiana attorney.