Federal & international regulations

Relevant data protection laws

Much of the university’s data is protected by statute. Key federal and state data protection laws relevant to the operations of the university and are collected on this page for easy reference.

Data Protection at Indiana University requires that every member of our community take appropriate measures to safeguard the privacy, security, and integrity of important data through its entire lifecycle, from creation to destruction.

Federal legislation

HIPAA – Health Information Portability and Accountability Act

Protects privacy of individually identifiable health information.

NETA – No Electronic Theft Act

Provides for criminal prosecution of individuals who engage in copyright infringement under certain circumstances, even when there is no monetary profit or commercial benefit from the infringement.

FERPA – Family Educational Rights & Privacy Act

Protects the privacy of student education records.

Wiretap Act

Broadly prohibits the intentional interception, use, or disclosure of wire and electronic communications unless a statutory exception applies.

ECPA – Electronic Communication Privacy Act

Sets provisions for the access, use, disclosure, interception and privacy protections of electronic communications.

USA Patriot Act

Purpose of this act is to deter and punish terrorist acts in the United States and around the world and to enhance law enforcement investigatory tools.

GDPR

EU General Data Protection Regulation

Indiana state legislation

Key Indiana state laws related to data protection include the SSN Disclosure Law, the Data Disposal Law, the Data Breach Notification Law, and the Consumer Report Security Freeze Law. For detailed information about these laws, see the Indiana Data Protection Laws FAQ.