Comprehensive state privacy law
Indiana privacy law
Indiana Consumer Data Protection Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Ind. Code §§ 24-15-1-1 to 24-15-11-2
- Official text
- https://iga.in.gov/ic/2026/Title_24.pdf
- In force
- January 1, 2026
- Effective dates
- January 1, 2026: main provisions; data protection impact assessments apply to processing activities created or generated after 31 Dec 2025 (IC 24-15-6-1(a))
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. No private right of action under the article or any other law (IC 24-15-10-4).
- Cure period
- 30 days. Before suing, the Attorney General must give 30 days' written notice; no action follows if the business cures and gives an express written statement that the violation is cured and steps are taken to prevent recurrence. The cure period is permanent. (IC 24-15-10-3)
- Rulemaking
- No. No rulemaking power; the Attorney General may publish resources and sample privacy notices (IC 24-15-4-6).
Amendments
- P.L. 236-2025, SEC. 5. Adds an entity exemption for tax-exempt 501(c)(4) organisations set up to detect or prevent insurance crime or fraud and subject to a memorandum of understanding with a statewide law enforcement agency (IC 24-15-1-1(b)(7)).
Topics
- ApplicabilityThe Act applies to persons doing business in Indiana or targeting its residents that, in a calendar year, handle personal data of at least 100,000 Indiana consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits, higher education institutions, public utilities and certain insurance-fraud organisations are exempt as entities.
- Consumer rightsConsumers may confirm and access, correct data they provided, delete, obtain a portable copy or representative summary of data they provided, and opt out of targeted advertising, sale and profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days.
- Sensitive dataSensitive data may be processed only with the consumer's opt-in consent; data of a known child (under 13) must be processed under COPPA. Indiana has no separate rule for teenagers.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish a privacy notice. Indiana does not require controllers to honour universal opt-out signals. Data protection impact assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing created after 31 Dec 2025.
- ProcessorsProcessors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, assessments (or an independent assessment) and subcontractor flow-down.
- EnforcementThe Attorney General enforces the Act exclusively after a permanent 30-day notice and cure period. Civil penalties are up to $7,500 per violation, plus investigation costs and attorney's fees. There is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Indiana statute
Reference material, not legal advice.