1. Home
  2. State breach laws
  3. Indiana

Indiana data breach notification law

What Indiana requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Ind. Code § 24-4.9-1-1 et seq. (notification duties in IC 24-4.9-3; enforcement in IC 24-4.9-4).

45 days
Notification deadline
Required
AG notification
No
Private right of action
None
Liability protection

What this means if you sell security services

Indiana's 45-day notification window means filings surface while remediation is still underway and the organization is still deciding what to change. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits.

See recent Indiana breach filings →

Requirements in detail

Statute
Ind. Code § 24-4.9-1-1 et seq. (notification duties in IC 24-4.9-3; enforcement in IC 24-4.9-4)
Deadline to notify residents
Without unreasonable delay, but no more than 45 days after discovering the breach. Delay is allowed only to restore the integrity of the system, to determine the scope of the breach, or at the request of the Attorney General or law enforcement, and notice must then go out as soon as possible once the delay is no longer needed.
Attorney General notification
Yes. Any business that must notify Indiana residents must also notify the Attorney General, regardless of how many residents are affected. The statute sets no separate deadline for the Attorney General notice, so the 45-day outer limit applies. Consumer reporting agencies must be notified when more than 1,000 consumers are notified.
Penalties
A failure to notify is a deceptive act that only the Attorney General can pursue. The Attorney General may seek an injunction, a civil penalty of up to $150,000 per deceptive act, and investigation and litigation costs. A failure to notify across a related series of breaches counts as one deceptive act.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Indiana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
None. Indiana has no law limiting breach lawsuits for organizations that maintain a security program.
Recent changes
Senate Enrolled Act 17 (Public Law 98-2024), effective July 1, 2024, expanded the definition of personal information to include information collected by adult-oriented website operators for age verification. The 2026 session made only technical wording changes (Public Laws 23-2026 and 115-2026).

Indiana breach notification FAQ

What is the data breach notification deadline in Indiana?

Without unreasonable delay, but no more than 45 days after discovering the breach. Delay is allowed only to restore the integrity of the system, to determine the scope of the breach, or at the request of the Attorney General or law enforcement, and notice must then go out as soon as possible once the delay is no longer needed. The governing law is Ind. Code § 24-4.9-1-1 et seq. (notification duties in IC 24-4.9-3; enforcement in IC 24-4.9-4).

Does Indiana require notifying the Attorney General of a data breach?

Yes. Any business that must notify Indiana residents must also notify the Attorney General, regardless of how many residents are affected. The statute sets no separate deadline for the Attorney General notice, so the 45-day outer limit applies. Consumer reporting agencies must be notified when more than 1,000 consumers are notified.

What are the penalties for failing to report a data breach in Indiana?

A failure to notify is a deceptive act that only the Attorney General can pursue. The Attorney General may seek an injunction, a civil penalty of up to $150,000 per deceptive act, and investigation and litigation costs. A failure to notify across a related series of breaches counts as one deceptive act.

Can individuals sue over a data breach in Indiana?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Indiana?

Indiana's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Indiana limit breach lawsuits for companies with a cybersecurity program?

No. Indiana has no law limiting breach lawsuits for organizations that maintain a security program.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Indiana Attorney General before relying on them.

Other states with a 45-day deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →