{"data":{"id":"us-in/ic-24-4.9-3-3","jurisdiction":"us-in","citation":"IC 24-4.9-3-3","heading":"Delay of disclosure or notification","body":"Sec. 3. (a) A person required to make a disclosure or notification under this chapter shall make the disclosure or notification without unreasonable delay, but not more than forty-five (45) days after the discovery of the breach. For purposes of this section, a delay is reasonable if the delay is:\n(1) necessary to restore the integrity of the computer system;\n(2) necessary to discover the scope of the breach; or\n(3) in response to a request from the attorney general or a law enforcement agency to delay disclosure because disclosure will:\n(A) impede a criminal or civil investigation; or\n(B) jeopardize national security.\n(b) A person required to make a disclosure or notification under this chapter shall make the disclosure or notification as soon as possible after:\n(1) delay is no longer necessary to restore the integrity of the computer system or to discover the scope of the breach; or\n(2) the attorney general or a law enforcement agency notifies the person that delay will no longer impede a criminal or civil investigation or jeopardize national security.","path":["TITLE 24. TRADE REGULATION","ARTICLE 4.9. DISCLOSURE OF SECURITY BREACH","Chapter 3. Disclosure and Notification Requirements"],"source_url":"https://iga.in.gov/ic/2026/Title_24.html#24-4.9-3-3","current_through":"2026","vintage":"2026","retrieved_at":"2026-09-04T18:50:41Z","sha256":"8ad6e22e09e49c2cb205b173726c228c72fb9d2d31441951aba2341b835ee864","source_id":"us-in","stale":false,"prev":"us-in/ic-24-4.9-3-2","next":"us-in/ic-24-4.9-3-3.5"},"notice":"GroundRules: Original legal text. Not legal advice."}