Ind. Code ch. 24-4.9-2

in effect

Ind. Code § 24-4.9-2-1 Applicability

Sec. 1. The definitions in this chapter apply throughout this article. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-2 "Breach of the security of data"

Sec. 2. (a) "Breach of the security of data" means unauthorized acquisition of computerized data that compromises the security, confidentiality, or integrity of personal information maintained by a person. The term includes the unauthorized acquisition of computerized data that have been transferred to another medium, including paper, microfilm, or a similar medium, even if the transferred data are no longer in a computerized format. (b) The term does not include the following: (1) Good faith acquisition of personal information by an employee or agent of the person for lawful purposes of the person, if the personal information is not used or subject to further unauthorized disclosure. (2) Unauthorized acquisition of a portable electronic device on which personal information is stored, if all personal information on the device is protected by encryption and the encryption key: (A) has not been compromised or disclosed; and (B) is not in the possession of or known to the person who, without authorization, acquired or has access to the portable electronic device. As added by P.L.125-2006, SEC.6. Amended by P.L.136-2008, SEC.2; P.L.137-2009, SEC.3.

Ind. Code § 24-4.9-2-3 "Data base owner"

Sec. 3. "Data base owner" means a person that owns or licenses computerized data that includes personal information. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-4 "Doing business in Indiana"

Sec. 4. "Doing business in Indiana" means owning or using the personal information of an Indiana resident for commercial purposes. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-5 Encrypted data

Sec. 5. Data are encrypted for purposes of this article if the data: (1) have been transformed through the use of an algorithmic process into a form in which there is a low probability of assigning meaning without use of a confidential process or key; or (2) are secured by another method that renders the data unreadable or unusable. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-6 "Financial institution"

Sec. 6. "Financial institution" means a financial institution as defined in: (1) IC 28-1-1-3, other than a consumer finance institution licensed to make supervised or regulated loans under IC 37-2; or (2) 15 U.S.C. 6809(3). As added by P.L.125-2006, SEC.6. Amended by P.L.115-2026, SEC.26.

Ind. Code § 24-4.9-2-7 "Indiana resident"

Sec. 7. "Indiana resident" means a person whose principal mailing address is in Indiana, as reflected in records maintained by the data base owner. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-8 "Mail"

Sec. 8. "Mail" has the meaning set forth in IC 23-1-20-15. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-9 "Person"

Sec. 9. "Person" means an individual, a corporation, a business trust, an estate, a trust, a partnership, an association, a nonprofit corporation or organization, a cooperative, or any other legal entity. As added by P.L.125-2006, SEC.6.

Ind. Code § 24-4.9-2-10 "Personal information"

Sec. 10. "Personal information" means: (1) a Social Security number that is not encrypted or redacted; (2) an individual's first and last names, or first initial and last name, and one (1) or more of the following data elements that are not encrypted or redacted: (A) A driver's license number. (B) A state identification card number. (C) A credit card number. (D) A financial account number or debit card number in combination with a security code, password, or access code that would permit access to the person's account; or (3) information collected by an adult oriented website operator, or their designee, under IC 24-4-23. The term does not include information that is lawfully obtained from publicly available information or from federal, state, or local government records lawfully made available to the general public. As added by P.L.125-2006, SEC.6. Amended by P.L.98-2024, SEC.2.

Ind. Code § 24-4.9-2-11 Redacted data or personal information

Sec. 11. (a) Data are redacted for purposes of this article if the data have been altered or truncated so that not more than the last four (4) digits of: (1) a driver's license number; (2) a state identification number; or (3) an account number; is accessible as part of personal information. (b) For purposes of this article, personal information is "redacted" if the personal information has been altered or truncated so that not more than five (5) digits of a Social Security number are accessible as part of personal information. As added by P.L.125-2006, SEC.6.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/24Fetched: 10/17/2026