--- title: "Indiana privacy law (ICDPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/indiana" source: "https://iga.in.gov/ic/2026/Title_24.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Indiana privacy law Indiana Consumer Data Protection Act Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** Ind. Code §§ 24-15-1-1 to 24-15-11-2 - **Official text:** https://iga.in.gov/ic/2026/Title_24.pdf - **Enacted:** [P.L. 94-2023 (Senate Enrolled Act 5, 2023)](https://iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf) - **In force:** January 1, 2026 - **Effective dates:** - **January 1, 2026:** main provisions; data protection impact assessments apply to processing activities created or generated after 31 Dec 2025 (IC 24-15-6-1(a)) - **Enforcer:** Attorney General (exclusive) - **Private right of action:** No. No private right of action under the article or any other law (IC 24-15-10-4). - **Cure period:** 30 days. Before suing, the Attorney General must give 30 days' written notice; no action follows if the business cures and gives an express written statement that the violation is cured and steps are taken to prevent recurrence. The cure period is permanent. (IC 24-15-10-3) - **Rulemaking:** No. No rulemaking power; the Attorney General may publish resources and sample privacy notices (IC 24-15-4-6). ## Amendments - [P.L. 236-2025, SEC. 5](https://iga.in.gov/ic/2026/Title_24.pdf). Adds an entity exemption for tax-exempt 501(c)(4) organisations set up to detect or prevent insurance crime or fraud and subject to a memorandum of understanding with a statewide law enforcement agency (IC 24-15-1-1(b)(7)). ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/indiana/applicability): The Act applies to persons doing business in Indiana or targeting its residents that, in a calendar year, handle personal data of at least 100,000 Indiana consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits, higher education institutions, public utilities and certain insurance-fraud organisations are exempt as entities. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/indiana/consumer-rights): Consumers may confirm and access, correct data they provided, delete, obtain a portable copy or representative summary of data they provided, and opt out of targeted advertising, sale and profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/indiana/sensitive-data): Sensitive data may be processed only with the consumer's opt-in consent; data of a known child (under 13) must be processed under COPPA. Indiana has no separate rule for teenagers. - [Controller duties](https://dposchool.com/state-privacy-laws/state/indiana/controller-duties): Controllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish a privacy notice. Indiana does not require controllers to honour universal opt-out signals. Data protection impact assessments are required for targeted advertising, sale, risky profiling, sensitive data and other high-risk processing created after 31 Dec 2025. - [Processors](https://dposchool.com/state-privacy-laws/state/indiana/processors): Processors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, assessments (or an independent assessment) and subcontractor flow-down. - [Enforcement](https://dposchool.com/state-privacy-laws/state/indiana/enforcement): The Attorney General enforces the Act exclusively after a permanent 30-day notice and cure period. Civil penalties are up to $7,500 per violation, plus investigation costs and attorney's fees. There is no private right of action. ## Sources - [Indiana Code 2026, Title 24, Article 15 (Consumer Data Protection), with history lines](https://iga.in.gov/ic/2026/Title_24.pdf) - [Senate Enrolled Act 5 (2023), enrolled text](https://iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf) - [Indiana Attorney General, Consumer Data Protection Bill of Rights](https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Indiana statute](https://iga.in.gov/ic/2026/Title_24.pdf) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Indiana Previous: [Maryland](https://dposchool.com/state-privacy-laws/state/maryland) Next: [Kentucky](https://dposchool.com/state-privacy-laws/state/kentucky) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents