Sec. 3. (a) A person required to make a disclosure or notification under this chapter shall make the disclosure or notification without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach. For purposes of this section, a delay is reasonable if the delay is:
(1) necessary to restore the integrity of the computer system;
(2) necessary to discover the scope of the breach; or
(3) in response to a request from the attorney general or a law enforcement agency to delay disclosure because disclosure will:
(A) impede a criminal or civil investigation; or
(B) jeopardize national security.
(b) A person required to make a disclosure or notification under this chapter shall make the disclosure or notification as soon as possible after:
(1) delay is no longer necessary to restore the integrity of the computer system or to discover the scope of the breach; or
(2) the attorney general or a law enforcement agency notifies the person that delay will no longer impede a criminal or civil investigation or jeopardize national security.
As added by P.L.125-2006, SEC.6. Amended by P.L.171-2022, SEC.1.
Structure Indiana Code
Article 4.9. Disclosure of Security Breach
Chapter 3. Disclosure and Notification Requirements
24-4.9-3-1. Disclosure of Breach
24-4.9-3-2. Notification of Data Base Owner
24-4.9-3-3. Delay of Disclosure or Notification
24-4.9-3-3.5. Duties of a Data Base Owner; Exceptions; Health Records; Enforcement Powers