Obligations United States Indiana
What a Indiana business has to have in writing
Indiana's written-policy load is moderate and mostly federal in shape. IOSHA runs the state OSHA plan and largely mirrors federal standards, and the Consumer Data Protection Act, in force since January 2026, adds a published privacy notice, consumer rights handling and documented data protection assessments for larger data processors.
Breach notice goes to both consumers and the Attorney General within 45 days, insurance licensees certify a written security program each April, and food establishments must keep a certified food handler on staff. Indiana has no state harassment training mandate, no pay transparency law and no paid leave statute.
Since 2025 the Office of Technology has also run its own Indiana RAMP programme, so cloud vendors selling to state agencies now carry a GovRAMP-aligned certification duty.
Headcount
Industry General is always on
Sponsored
Policy Acknowledgment Proof
IndianaHandbook 2026acknowledged by name
Indiana on Recordwith AllyMatter
Cover Indiana the Modern WayEvery policy Indiana makes you write, acknowledged by name
01
Approve it, lock the version
Non-author approval, obsolete copies blocked
02
Every employee in Indiana on record
Who read which version, and when
03
Walk into any state inspection with the trail
From $29/mo, 20 editors, unlimited staff (published)
What applies
Indiana rules for a 15–19 person general business
State law only. The federal layer every employer carries sits on the business-type pages below. Each row names what you must write, post, file or certify, who enforces it, and links to the state authority.
Breach Notification 1Who you must tell after a data breach, and how fast
LawProduceWhat it requiresTriggerEnforced by
Disclosure of Security BreachAI-compiledInd. Code art. 24-4.9Any person or business that owns or licenses computerized personal information about Indiana residentsDistribute
Notice
Notify affected Indiana residents and the Attorney General without unreasonable delay and no later than 45 days after discovering a breach, using the Attorney General's breach notification form; describe the incident and the data involved and tell people how to protect themselves.
From the first employee
Indiana Attorney General, Consumer Protection Division
Data Security Program 1A written safeguards program the state requires before anything goes wrong
LawProduceWhat it requiresTriggerEnforced by
Reasonable safeguards and secure disposal of personal informationAI-compiledInd. Code § 24-4.9-3-3.5(c); Ind. Code § 24-4-14-8Any business that owns or licenses personal information about Indiana residents, and anyone disposing of unencrypted customer personal informationWrite
Written policy
Put reasonable procedures in place to protect and keep confidential the personal information the business holds, and shred, incinerate, erase or otherwise render illegible any unencrypted personal information before discarding it. Disposing of records for more than 100 customers without doing this is a higher-grade infraction.
From the first employee
Indiana Attorney General, Consumer Protection Division
Consumer Privacy Law 1Rights, notices and assessments for consumer data
LawProduceWhat it requiresTriggerEnforced by
Indiana Consumer Data Protection ActAI-compiledInd. Code art. 24-15 (Public Law 94-2023, SB 5)Businesses operating in Indiana or targeting Indiana residents that, in a calendar year, control or process personal data of 100,000+ Indiana consumers, or 25,000+ consumers while getting more than half of gross revenue from selling personal dataWrite
Written policy
Publish a privacy notice listing the categories of personal data processed, the purposes, how consumers exercise and appeal their rights, what is shared and with whom; record data protection assessments before targeted advertising, data sales, risky profiling or sensitive data processing; get consent before processing sensitive data; put processing terms in contracts with processors; and honor access, correction, deletion, portability and opt-out requests within 45 days.
From the first employee
Indiana Attorney General (exclusive; 30-day cure period)
Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data
LawProduceWhat it requiresTriggerEnforced by
Biometric data as sensitive data under the Indiana Consumer Data Protection ActAI-compiledInd. Code §§ 24-15-2-4 (biometric data), 24-15-2-28 (sensitive data), 24-15-4-1; art. 24-15 (Public Law 94-2023)Indiana has no standalone biometric statute of the Illinois BIPA type. Biometric data is handled as sensitive data inside the Consumer Data Protection Act, which reaches controllers that in a calendar year handle personal data of 100,000 or more Indiana consumers, or of 25,000 or more while earning over half of gross revenue from selling personal dataWrite
Written policy
Biometric data means data generated by automatic measurement of biological characteristics such as a fingerprint, a voiceprint or retina and iris images. Processing it to uniquely identify a specific person makes it sensitive data, and a controller must not process sensitive data without the consumer's consent, meaning a clear affirmative act that is freely given, specific, informed and unambiguous. Describe the category in the privacy notice, run the secure request route the Act requires, and complete and keep a documented data protection assessment for the processing.
From the first employee
Indiana Attorney General
Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA
LawProduceWhat it requiresTriggerEnforced by
Indiana Occupational Safety and Health Act (IOSHA State Plan)AI-compiledInd. Code art. 22-8; 610 IACAll private-sector and state and local government employers in IndianaWrite
Written program
Follow the safety and health standards IOSHA adopts, which track federal OSHA with some Indiana additions; post the IOSHA safety and health protection poster, keep OSHA 300 injury and illness records where required, post the 300A summary each February through April, and report fatalities and serious hospitalizations to IOSHA. Written programs are required where the underlying standard calls for one, such as hazard communication, lockout/tagout, respiratory protection and confined spaces.
From the first employee
Indiana Occupational Safety and Health Administration, Indiana Department of Labor
Insurance Data Security 1The written security program insurance licensees must certify
LawProduceWhat it requiresTriggerEnforced by
Insurance Data Security LawAI-compiledInd. Code ch. 27-2-27Insurance licensees regulated under Title 27; small licensees below the statutory employee threshold and those covered by HIPAA security rules qualify for exemptionsCertify
Certification
Keep a written comprehensive information security program based on a risk assessment that protects nonpublic information and information systems, name someone responsible, oversee third-party providers, maintain a written incident response plan, and report to the board. Indiana-domiciled insurers file an annual compliance certification with the Department of Insurance by April 15 and must notify the Department of a cybersecurity event.
From the first employee
Indiana Department of Insurance
State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state
LawProduceWhat it requiresTriggerEnforced by
Indiana RAMP policy for cloud offeringsAI-compiledIndiana Office of Technology Policy P.05, Indiana RAMP Policy for Cloud Offerings, made under the Governor's executive order on StateRAMPCloud service providers selling to Indiana executive branch agencies and to any entity that connects to state systems or infrastructureCertify
Certification
Reach the GovRAMP level the Office of Technology sets for the data involved, or file a plan of action to get there. Indiana runs three tiers, Core for nonconfidential data, Authorized for confidential data, and Authorized with the CJIS overlay for criminal justice data, each mapping to a different set of NIST 800-53 controls. New state contracts have carried the requirement since the state fiscal year opening on July 1, 2025, and existing vendors must show compliance or a plan before their next renewal is executed. Cloud offerings cannot be bought or used until the Office of Technology approves them, and a solicitation must reach the Office at least 90 days before it goes out to bidders.
From the first employee
Indiana Office of Technology
Required Postings 1The notices every workplace in the state must display
LawProduceWhat it requiresTriggerEnforced by
Required workplace postersAI-compiledInd. Code arts. 22-2 (wages), 22-4 (unemployment), 22-8 (safety), 20-33-3 (youth employment)Every Indiana employerPost
Posting
Display the state poster set, which includes the IOSHA safety and health protection notice, minimum wage, teen work hour restrictions, unemployment insurance and workers' compensation notices, where employees can read them.
From the first employee
Indiana Department of Labor; Indiana Department of Workforce Development; Worker's Compensation Board of Indiana
Licensing and Certifications 4Registrations, licences and certifications a business or its staff must hold
LawProduceWhat it requiresTriggerEnforced by
Business entity registration (Secretary of State, INBiz)AI-compiledInd. Code art. 23-0.5 (uniform business organizations); Ind. Code art. 23-1 (corporations); Ind. Code art. 23-18 (LLCs)Any corporation, LLC, LP, nonprofit or out-of-state entity doing business in IndianaFile
Filing / record
File formation or foreign registration documents through the INBiz portal, appoint an Indiana registered agent, and file the business entity report every one or two years depending on entity type to stay in good standing.
From the first employee
Indiana Secretary of State, Business Services Division
Registered Retail Merchant CertificateAI-compiledInd. Code art. 6-2.5 (sales tax)Any business selling tangible goods or taxable services at retail in Indiana, including remote sellers meeting the economic thresholdFile
Filing / record
Register with the Department of Revenue through INBiz, get a Registered Retail Merchant Certificate for each business location, display the certificate at that location, renew it as the Department requires, and file sales tax and withholding returns.
From the first employee
Indiana Department of Revenue
Food establishment permit and certified food handlerAI-compiledInd. Code art. 16-42; 410 IAC 7-24 (retail food); 410 IAC 7-22 (food handler certification)Restaurants, groceries, mobile units, caterers and other retail food establishmentsCertify
Certification
Hold a permit from the local health department, pass inspections, and keep at least one employee with a certified food handler credential from an accredited program working at the establishment; keep the certificate on site and a person in charge on duty who can answer the inspector's food safety questions.
From the first employee
Indiana Department of Health, Food Protection Program; local health departments
Trade licenses (Professional Licensing Agency)AI-compiledInd. Code art. 25-28.5 (plumbing); other Title 25 articles by tradePlumbing contractors and other regulated trades and professions; Indiana has no statewide general contractor license, so general construction licensing is localFile
Filing / record
Hold the state license for the regulated trade before doing the work, carry the bond and insurance the board requires, renew on the board's cycle with continuing education, and show the license number where the rules require it. General contractors register or license with the city or county instead.
From the first employee
Indiana Professional Licensing Agency and its boards and commissions
Other Written Policies 4Any other document the state makes an employer write or hand out
LawProduceWhat it requiresTriggerEnforced by
Pregnancy accommodation requestsAI-compiledInd. Code ch. 22-9-12Indiana employers with 15 or more employeesWrite
Written policy
Take written accommodation requests related to pregnancy, childbirth or related medical conditions, respond within a reasonable time, and do not discipline, fire or otherwise retaliate against an employee for asking for or using an accommodation. Employers usually document the request-and-response process in a written accommodation procedure.
15+ employees
Indiana Civil Rights Commission; private civil action
Youth employment (Youth Employment System)AI-compiledInd. Code ch. 20-33-3Any Indiana employer that hires workers under 18File
Filing / record
Register in the Department of Labor's Youth Employment System and report each minor hired, follow the hour and time-of-day limits and prohibited-occupation rules for 14 to 17 year olds, keep the records the system requires, and post the teen work hour restrictions notice.
From the first employee
Indiana Department of Labor
Workers' compensation coverage and postingAI-compiledInd. Code art. 22-3Nearly every Indiana employer with employees, with narrow statutory exemptionsPost
Posting
Carry workers' compensation and occupational disease insurance or qualify as a self-insurer, post the notice naming the carrier and explaining how to report an injury, report injuries to the Worker's Compensation Board on the state form, and keep the injury records the Board requires.
From the first employee
Worker's Compensation Board of Indiana
New hire reportingAI-compiledInd. Code § 22-4-10-8; 42 U.S.C. § 653aEvery Indiana employerFile
Filing / record
Report each newly hired or rehired employee to the Indiana New Hire Reporting Center within 20 days of the hire date, with the employer's federal identification number and the employee's name, address, Social Security number and start date.
From the first employee
Indiana Department of Workforce Development; Indiana Department of Child Services (child support enforcement)
From the publisher
Keep Your Written Policies in One Place
Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.
See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff
Add the federal layer
Your business type, with Indiana on top
Small businessFederal + industry, with Indiana on topConstruction contractorsFederal + industry, with Indiana on topHealthcare practicesFederal + industry, with Indiana on topFood and beverage businessesFederal + industry, with Indiana on topTax and accounting firmsFederal + industry, with Indiana on topRegistered investment advisersFederal + industry, with Indiana on topInsurance agenciesFederal + industry, with Indiana on topRetail and e-commerceFederal + industry, with Indiana on topTrucking and logistics carriersFederal + industry, with Indiana on topNonprofitsFederal + industry, with Indiana on topFederal contractorsFederal + industry, with Indiana on top
Other states
The same index for another state
Alabama12Alaska12Arizona11Arkansas14California20Colorado18Connecticut17Delaware17District of Columbia12Florida15Georgia13Hawaii16Idaho13Illinois19Iowa13Kansas11Kentucky14Louisiana13Maine14Maryland19Massachusetts16Michigan15Minnesota19Mississippi11Missouri12Montana15Nebraska13Nevada18New Hampshire13New Jersey19New Mexico13New York17North Carolina12North Dakota13Ohio13Oklahoma11Oregon19Pennsylvania12Rhode Island13South Carolina12South Dakota11Tennessee14Texas15Utah13Vermont17Virginia17Washington21West Virginia14Wisconsin15Wyoming13
Need a hand implementing it?
Find a Consultant Who Does This Work
Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.
Sources
Indiana Attorney General - Security BreachesIndiana Attorney General - Security Breach FAQs and Notification Form for BusinessesIndiana General Assembly - Indiana Code Title 24Indiana General Assembly - Indiana Code Article 24-15 (PDF)Indiana Attorney General - Consumer Protection DivisionIndiana Department of Insurance - Data SecurityIndiana General Assembly - Indiana Code Title 27Indiana Department of LaborOSHA - Indiana State PlanIndiana Department of Labor - Publications and postersIndiana Department of Workforce Development - Required Employer PostersIndiana Secretary of State - Business ServicesINBiz - Indiana's one-stop business portalIndiana Department of Revenue - Business TaxIndiana Department of Health - Food ProtectionIndiana General Assembly - Indiana Code Title 16Indiana Professional Licensing AgencyIndiana General Assembly - Indiana Code Title 25Indiana Civil Rights CommissionIndiana General Assembly - Indiana Code Title 22Indiana General Assembly - Indiana Code Title 20Worker's Compensation Board of IndianaIndiana Department of Workforce DevelopmentIndiana Attorney General - Indiana Consumer Data Protection Consumer Bill of RightsIndiana General Assembly - Senate Bill 5 (2023) as enrolledIndiana Office of Technology - RAMP Cybersecurity FAQsIndiana Office of Technology - When must vendors be compliant with the RAMP policy?Indiana Office of Technology - Policy P.05, Indiana RAMP Policy for Cloud Offerings