Sec. 3. If a breach occurs of the security of records that:
(1) are maintained by a loan processing company under this chapter; and
(2) contain the unencrypted, unredacted personal information of one (1) or more borrowers or prospective borrowers;
the loan processing company is subject to the disclosure requirements under IC 24-4.9-3. However, this section does not apply if the loan processor is exempt from the disclosure requirements under IC 24-4.9-3-4.