DPO SchoolDPO School

Indiana Consumer Data Protection Act

Indiana privacy law (ICDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act applies to persons doing business in Indiana or targeting its residents that, in a calendar year, handle personal data of at least 100,000 Indiana consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits, higher education institutions, public utilities and certain insurance-fraud organisations are exempt as entities.

Key points

  1. Thresholds: 100,000 Indiana consumers, or 25,000 plus more than 50% of gross revenue from sales, in a calendar year.

    Section: IC 24-15-1-1(a)

  2. GLBA: financial institutions and affiliates, or data subject to GLBA Title V, are exempt.

    Section: IC 24-15-1-1(b)(2)

  3. HIPAA covered entities and business associates are exempt as entities; protected health information is exempt as data.

    Section: IC 24-15-1-1(b)(3); IC 24-15-1-2(1)

  4. Nonprofits and institutions of higher education are exempt as entities.

    Section: IC 24-15-1-1(b)(4)-(5)

  5. Public utilities and their service companies are exempt, and since P.L. 236-2025 so are certain 501(c)(4) insurance-fraud organisations.

    Section: IC 24-15-1-1(b)(6)-(7)

  6. Employment-context data and other regulated data types are exempt.

    Section: IC 24-15-1-2

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Indiana statute

Reference material, not legal advice.