ShareAndGoShareAndGo

Data breach notification

Indiana data breach notification law

Indiana's breach notice law is Ind. Code art. 24-4.9, with disclosure in chapter 3 and definitions in chapter 2.

This page was checked against the Indiana Code 2026, as the Indiana General Assembly publishes it.

Forty-five days from discovery

Section 24-4.9-3-3 requires disclosure "without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach." The 45-day limit was added by a 2022 amendment, P.L.171-2022.

The section treats a delay as reasonable if it is necessary to restore the integrity of the computer system, necessary to discover the scope of the breach, or requested by the attorney general or a law enforcement agency because disclosure would impede a criminal or civil investigation or jeopardize national security. Once that reason ends, disclosure must follow as soon as possible. The section does not say whether such a delay can run past the 45 days.

Who else must hear

  • Attorney General: any data base owner that discloses to Indiana residents "shall also disclose the breach to the attorney general", with no minimum number of residents.
  • Consumer reporting agencies: told when the disclosure goes to more than 1,000 consumers.
  • Data base owner: a person that maintains the data without owning it notifies the owner.

The identity theft or fraud test

Disclosure is owed if the data base owner "knows, should know, or should have known" that the acquisition "has resulted in or could result in identity deception", identity theft, or fraud affecting the Indiana resident.

Encryption matters too. The duty covers unencrypted personal information, and encrypted personal information only where the unauthorized person had access to the encryption key.

Personal information in Indiana

Section 24-4.9-2-10 covers a Social Security number that is not encrypted or redacted. It also covers a first and last name, or first initial and last name, with one or more of these, not encrypted or redacted:

  • A driver's license number
  • A state identification card number
  • A credit card number
  • A financial account number or debit card number with a security code, password or access code that would permit access to the account

A third branch covers information an adult oriented website operator collects under IC 24-4-23. Information lawfully obtained from public sources or public government records is outside the definition.

Paper can count. A breach includes unauthorized acquisition of computerized data that have been moved to paper, microfilm or a similar medium.

Who follows their own plan

A data base owner that keeps its own disclosure procedures in a privacy or security policy need not make a separate disclosure, if that policy is at least as stringent as the chapter's disclosure requirements. Federal compliance plans under laws such as HIPAA and the Fair Credit Reporting Act, and financial institutions following the federal interagency guidance, have similar carve-outs in section 24-4.9-3-4. State agencies and the judicial and legislative departments are outside the article.

Where ShareAndGo fits

Records matter most when you need to reconstruct events quickly.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

Watermarking is a per-room setting and it is on by default, so each page a reader views carries that reader's email address and the date. Each recipient confirms their email with a six-digit code and needs no account, which means the log speaks in confirmed addresses. Groups see only their own folders, so the list of people who could have opened a file is short and known. The chained log exports as CSV whenever you need it outside the room.

Indiana questions

What is Indiana's breach notification statute?
Indiana Code article 24-4.9. The timing rule is section 24-4.9-3-3.
How fast must residents be told?
Without unreasonable delay, and not more than 45 days after the discovery of the breach.
Is a Social Security number alone enough to count?
Yes, if it is not encrypted or redacted. The other data elements count when paired with a name.
Does the Indiana Attorney General need to be told?
Yes. A data base owner that discloses to residents must also disclose the breach to the attorney general, and the section sets no minimum number of residents.

Checked and dated

Checked against the Indiana Code 2026, as published by the Indiana General Assembly, on November 3, 2026. This is general information, not legal advice.

Keep reading

Breach notification laws by state

The full list of breach notice laws.

ShareAndGo vs DataRooms.com

A data room comparison focused on audit trails.

ShareAndGo

The ShareAndGo home page.