An amendment to the Indiana Code Concerning Trade Regulation was signed by the Indiana Governor on March 18, 2022. This changes the required timescales of reporting a data breach. These changes come into effect on July 1, 2022.
If an organization were to discover a data breach in Indiana between today and June 30, 2022, then it must be report “without unreasonable delay”. However, from July 1, and breaches must be report within 45 days of discovering the breach.
A necessary delay is a delay due to the following reasons:
- To restore the integrity of the computer system
- Needed to discover the scope of the breach.
- In response to a request from the attorney general or a law enforcement agency to delay disclose for fear it will:
- Impede a criminal or civil investigation
- Jeopardize national security.
This criteria of “necessary delay” remains the same despite the amendment.
You can see what other changes are being made to data and privacy laws in the world here.
