# Ind. Code § 24-4.9-3-1: Disclosure of breach

> Indiana · Statutes · In force

URL: https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-1

## Section

- **Citation:** Ind. Code § 24-4.9-3-1
- **Heading:** Disclosure of breach
- **Jurisdiction:** Indiana
- **Kind:** Statutes
- **Status:** In force
- **Text as of:** August 14, 2026
- **Source:** Compiled text
- **Location:** Indiana Code / Title 24 / Article 4.9 / Chapter 3 / Section 24-4.9-3-1

## Text

Sec. 1. (a) Except as provided in section 4(c), 4(d), and 4(e) of this chapter, after discovering or being notified of a breach of the security of data, the data base owner shall disclose the breach to an Indiana resident whose:

(1) unencrypted personal information was or may have been acquired by an unauthorized person; or

(2) encrypted personal information was or may have been acquired by an unauthorized person with access to the encryption key;

if the data base owner knows, should know, or should have known that the unauthorized acquisition constituting the breach has resulted in or could result in identity deception (as defined in IC 35-43-5-3.5), identity theft, or fraud affecting the Indiana resident.

(b) A data base owner required to make a disclosure under subsection (a) to more than one thousand (1,000) consumers shall also disclose to each consumer reporting agency (as defined in 15 U.S.C. 1681a(p)) information necessary to assist the consumer reporting agency in preventing fraud, including personal information of an Indiana resident affected by the breach of the security of a system.

(c) If a data base owner makes a disclosure described in subsection (a), the data base owner shall also disclose the breach to the attorney general.

As added by P.L.125-2006, SEC.6. Amended by P.L.137-2009, SEC.4.

## Nearby sections

- [Ind. Code § 24-4.9-3-1 Disclosure of breach](https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-1.md)
- [Ind. Code § 24-4.9-3-2 Notification of data base owner](https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-2.md)
- [Ind. Code § 24-4.9-3-3 Delay of disclosure or notification](https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-3.md)
- [Ind. Code § 24-4.9-3-3.5 Duties of a data base owner; exceptions; health records; enforcement powers](https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-3.5.md)
- [Ind. Code § 24-4.9-3-4 Method of disclosure; exceptions](https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-4.md)

---

Source: Frix Law Library, https://www.frixlaw.com/law-library/statutes/STATE_IN_T24_A4.9_C3_S24-4.9-3-1. Check the current official text before relying on it. Not legal advice.