Home›Obligations›United States›By state›Indiana

What a Indiana business has to have in writing

Indiana's written-policy load is moderate and mostly federal in shape. IOSHA runs the state OSHA plan and largely mirrors federal standards, and the Consumer Data Protection Act, in force since January 2026, adds a published privacy notice, consumer rights handling and documented data protection assessments for larger data processors.

Breach notice goes to both consumers and the Attorney General within 45 days, insurance licensees certify a written security program each April, and food establishments must keep a certified food handler on staff. Indiana has no state harassment training mandate, no pay transparency law and no paid leave statute.

Since 2025 the Office of Technology has also run its own Indiana RAMP program, so cloud vendors selling to state agencies now carry a GovRAMP-aligned certification duty.

Indiana has a rule of its own in 10 of the 14 areas, listed below. In 4 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so those are not shown yet.

Headcount

Industry General is always on

Ad from the publisher

Policy Acknowledgment Proof

IndianaHandbook 2026acknowledged by name

Indiana on Recordwith AllyMatter

Cover Indiana the Modern WayEvery policy Indiana makes you write, acknowledged by name

Approve it, lock the version

Non-author approval, obsolete copies blocked

Every employee in Indiana on record

Who read which version, and when

Walk into any state inspection with the trail

From $29/mo, 20 editors, unlimited staff (published)

See how it works →Pricing →

Indiana rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Indiana has a rule of its own on top. The federal rules every employer carries follow the Indiana rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by

Disclosure of Security BreachInd. Code art. 24-4.9 #Any person or business that owns or licenses computerized personal information about Indiana residentsDistribute

Notice

Notify affected Indiana residents and the Attorney General without unreasonable delay and no later than 45 days after discovering a breach, using the Attorney General's breach notification form; describe the incident and the data involved and tell people how to protect themselves.

From the first employee

Indiana Attorney General, Consumer Protection Division

AuthorityIndiana Attorney General - Security Breaches Indiana Attorney General - Security Breach FAQs and Notification Form for Businesses Indiana General Assembly - Indiana Code Title 24 Report an error

Data Security Program 1A written safeguards program the state requires before anything goes wrong

LawProduceWhat it requiresTriggerEnforced by

Reasonable safeguards and secure disposal of personal informationInd. Code § 24-4.9-3-3.5(c); Ind. Code § 24-4-14-8 #Any business that owns or licenses personal information about Indiana residents, and anyone disposing of unencrypted customer personal informationWrite

Written policy

Put reasonable procedures in place to protect and keep confidential the personal information the business holds, and shred, incinerate, erase or otherwise render illegible any unencrypted personal information before discarding it. Disposing of records for more than 100 customers without doing this is a higher-grade infraction.

From the first employee

Indiana Attorney General, Consumer Protection Division

AuthorityIndiana Attorney General - Security Breaches Indiana General Assembly - Indiana Code Title 24 Report an error

Consumer Privacy Law 1Rights, notices and assessments for consumer data

LawProduceWhat it requiresTriggerEnforced by

Indiana Consumer Data Protection ActInd. Code art. 24-15 (Public Law 94-2023, SB 5) #Businesses operating in Indiana or targeting Indiana residents that, in a calendar year, control or process personal data of 100,000+ Indiana consumers, or 25,000+ consumers while getting more than half of gross revenue from selling personal dataWrite

Written policy

Publish a privacy notice listing the categories of personal data processed, the purposes, how consumers exercise and appeal their rights, what is shared and with whom; record data protection assessments before targeted advertising, data sales, risky profiling or sensitive data processing; get consent before processing sensitive data; put processing terms in contracts with processors; and honor access, correction, deletion, portability and opt-out requests within 45 days.

From the first employee

Indiana Attorney General (exclusive; 30-day cure period)

AuthorityIndiana General Assembly - Indiana Code Article 24-15 (PDF)Indiana General Assembly - Indiana Code Title 24 Indiana Attorney General - Consumer Protection Division Report an error

Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data

LawProduceWhat it requiresTriggerEnforced by

Biometric data as sensitive data under the Indiana Consumer Data Protection ActInd. Code §§ 24-15-2-4 (biometric data), 24-15-2-28 (sensitive data), 24-15-4-1; art. 24-15 (Public Law 94-2023) #Indiana has no standalone biometric statute of the Illinois BIPA type. Biometric data is handled as sensitive data inside the Consumer Data Protection Act, which reaches controllers that in a calendar year handle personal data of 100,000 or more Indiana consumers, or of 25,000 or more while earning over half of gross revenue from selling personal dataWrite

Written policy

Biometric data means data generated by automatic measurement of biological characteristics such as a fingerprint, a voiceprint or retina and iris images. Processing it to uniquely identify a specific person makes it sensitive data, and a controller must not process sensitive data without the consumer's consent, meaning a clear affirmative act that is freely given, specific, informed and unambiguous. Describe the category in the privacy notice, run the secure request route the Act requires, and complete and keep a documented data protection assessment for the processing.

From the first employee

Indiana Attorney General

AuthorityIndiana General Assembly - Indiana Code article 24-15, Consumer Data Protection Indiana Attorney General - Indiana Consumer Data Protection Consumer Bill of Rights Indiana General Assembly - Senate Bill 5 (2023) as enrolled Report an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by

Indiana Occupational Safety and Health Act (IOSHA State Plan)Ind. Code art. 22-8; 610 IAC #All private-sector and state and local government employers in IndianaWrite

Written program

Follow the safety and health standards IOSHA adopts, which track federal OSHA with some Indiana additions; post the IOSHA safety and health protection poster, keep OSHA 300 injury and illness records where required, post the 300A summary each February through April, and report fatalities and serious hospitalizations to IOSHA. Written programs are required where the underlying standard calls for one, such as hazard communication, lockout/tagout, respiratory protection and confined spaces.

From the first employee

Indiana Occupational Safety and Health Administration, Indiana Department of Labor

AuthorityIndiana Department of Labor OSHA - Indiana State Plan Indiana Department of Labor - Publications and posters Report an error

State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state

LawProduceWhat it requiresTriggerEnforced by

Indiana RAMP policy for cloud offeringsIndiana Office of Technology Policy P.05, Indiana RAMP Policy for Cloud Offerings, made under the Governor's executive order on StateRAMP #Cloud service providers selling to Indiana executive branch agencies and to any entity that connects to state systems or infrastructureCertify

Certification

Reach the GovRAMP level the Office of Technology sets for the data involved, or file a plan of action to get there. Indiana runs three tiers, Core for nonconfidential data, Authorized for confidential data, and Authorized with the CJIS overlay for criminal justice data, each mapping to a different set of NIST 800-53 controls. New state contracts have carried the requirement since the state fiscal year opening on July 1, 2025, and existing vendors must show compliance or a plan before their next renewal is executed. Cloud offerings cannot be bought or used until the Office of Technology approves them, and a solicitation must reach the Office at least 90 days before it goes out to bidders.

From the first employee

Indiana Office of Technology

AuthorityIndiana Office of Technology - RAMP Cybersecurity FAQs Indiana Office of Technology - When must vendors be compliant with the RAMP policy?Indiana Office of Technology - Policy P.05, Indiana RAMP Policy for Cloud Offerings Report an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by

Required workplace postersInd. Code arts. 22-2 (wages), 22-4 (unemployment), 22-8 (safety), 20-33-3 (youth employment) #Every Indiana employerPost

Posting

Display the state poster set, which includes the IOSHA safety and health protection notice, minimum wage, teen work hour restrictions, unemployment insurance and workers' compensation notices, where employees can read them.

From the first employee

Indiana Department of Labor; Indiana Department of Workforce Development; Worker's Compensation Board of Indiana

AuthorityIndiana Department of Labor - Publications and posters Indiana Department of Workforce Development - Required Employer Posters Report an error

Licensing and Certifications 2Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by

Business entity registration (Secretary of State, INBiz)Accessed and verified 2026-10-02Ind. Code art. 23-0.5 (uniform business organizations); Ind. Code art. 23-1 (corporations); Ind. Code art. 23-18 (LLCs) #Any corporation, LLC, LP, nonprofit or out-of-state entity doing business in IndianaFile

Filing / record

File formation or foreign registration documents through the INBiz portal, appoint an Indiana registered agent, and file the periodic business entity report the Secretary of State requires to stay in good standing.

From the first employee

Indiana Secretary of State, Business Services Division

AuthorityIndiana Secretary of State - Business Services INBiz - Indiana's one-stop business portal Report an error

Registered Retail Merchant CertificateAccessed and verified 2026-10-02Ind. Code art. 6-2.5 (sales tax) #Any business selling tangible goods or taxable services at retail in Indiana, including remote sellers meeting the economic thresholdFile

Filing / record

Register with the Department of Revenue through INBiz, get a Registered Retail Merchant Certificate for each business location, display the certificate at that location, keep it current (it renews automatically unless there are unfiled returns or outstanding liabilities), and file sales tax and withholding returns.

From the first employee

Indiana Department of Revenue

AuthorityIndiana Department of Revenue - Business Tax INBiz - Indiana's one-stop business portal Report an error

Because You Are in Construction 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Trade licenses (Professional Licensing Agency)Ind. Code art. 25-28.5 (plumbing); other Title 25 articles by trade #Plumbing contractors and other regulated trades and professions; Indiana has no statewide general contractor license, so general construction licensing is localFile

Filing / record

Hold the state license for the regulated trade before doing the work, carry the bond and insurance the board requires, renew on the board's cycle with continuing education, and show the license number where the rules require it. General contractors register or license with the city or county instead.

From the first employee

Indiana Professional Licensing Agency and its boards and commissions

AuthorityIndiana Professional Licensing Agency Indiana General Assembly - Indiana Code Title 25 Report an error

Because You Are in Food & Beverage 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Food establishment permit and certified food handlerAccessed and verified 2026-10-02Ind. Code art. 16-42; 410 IAC 7-24 (retail food); 410 IAC 7-22 (food handler certification) #Restaurants, groceries, mobile units, caterers and other retail food establishmentsCertify

Certification

Hold a permit from the local health department, pass inspections, and keep a person in charge on duty who can identify and take immediate corrective action on food safety risks.

From the first employee

Indiana Department of Health, Food Protection Program; local health departments

AuthorityIndiana Department of Health - Food Protection Indiana General Assembly - Indiana Code Title 16 Report an error

Because You Are in Financial & Tax 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Insurance Data Security LawInd. Code ch. 27-2-27 #Insurance licensees regulated under Title 27; small licensees below the statutory employee threshold and those covered by HIPAA security rules qualify for exemptionsCertify

Certification

Keep a written comprehensive information security program based on a risk assessment that protects nonpublic information and information systems, name someone responsible, oversee third-party providers, maintain a written incident response plan, and report to the board. Indiana-domiciled insurers file an annual compliance certification with the Department of Insurance by April 15 and must notify the Department of a cybersecurity event.

From the first employee

Indiana Department of Insurance

AuthorityIndiana Department of Insurance - Data Security Indiana General Assembly - Indiana Code Title 27 Report an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Indiana on top

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

Indiana Attorney General - Security BreachesIndiana Attorney General - Security Breach FAQs and Notification Form for BusinessesIndiana General Assembly - Indiana Code Title 24Indiana General Assembly - Indiana Code Article 24-15 (PDF)Indiana Attorney General - Consumer Protection DivisionIndiana Department of Insurance - Data SecurityIndiana General Assembly - Indiana Code Title 27Indiana Department of LaborOSHA - Indiana State PlanIndiana Department of Labor - Publications and postersIndiana Department of Workforce Development - Required Employer PostersIndiana Secretary of State - Business ServicesINBiz - Indiana's one-stop business portalIndiana Department of Revenue - Business TaxIndiana Department of Health - Food ProtectionIndiana General Assembly - Indiana Code Title 16Indiana Professional Licensing AgencyIndiana General Assembly - Indiana Code Title 25Indiana Civil Rights CommissionIndiana General Assembly - Indiana Code Title 22Indiana General Assembly - Indiana Code Title 20Worker's Compensation Board of IndianaIndiana Department of Workforce DevelopmentIndiana Attorney General - Indiana Consumer Data Protection Consumer Bill of RightsIndiana General Assembly - Senate Bill 5 (2023) as enrolledIndiana Office of Technology - RAMP Cybersecurity FAQsIndiana Office of Technology - When must vendors be compliant with the RAMP policy?Indiana Office of Technology - Policy P.05, Indiana RAMP Policy for Cloud Offerings

What a Indiana business has to have in writing

Headcount

Industry General is always on

Indiana rules for a 15–19 person general business

Breach Notification 1Who you must tell after a data breach, and how fast

Data Security Program 1A written safeguards program the state requires before anything goes wrong

Consumer Privacy Law 1Rights, notices and assessments for consumer data

Biometric and Health Data 1Consent and retention rules for fingerprints, faces and health data

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

State Vendor Security Program 1Certification a vendor needs before selling cloud services to the state

Required Postings 1The notices every workplace in the state must display

Licensing and Certifications 2Registrations, licenses and certifications a business or its staff must hold

Other Written Policies 4Any other document the state makes an employer write or hand out

Because You Are in Construction 1Industry layer

Because You Are in Food & Beverage 1Industry layer

Because You Are in Financial & Tax 1Industry layer

Federal rules for a 15–19 person general business

Keep Your Written Policies in One Place

Your business type, with Indiana on top

For another state

Find a Consultant Who Does This Work

Sources

About this data

Think something is wrong?

Want to advertise here?