DPO SchoolDPO School

Indiana Consumer Data Protection Act

Indiana privacy law (ICDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General enforces the Act exclusively after a permanent 30-day notice and cure period. Civil penalties are up to $7,500 per violation, plus investigation costs and attorney's fees. There is no private right of action.

Key points

  1. Exclusive enforcement by the Attorney General.

    Section: IC 24-15-10-1

  2. Injunction and civil penalty of up to $7,500 per violation, plus reasonable expenses.

    Section: IC 24-15-10-2

  3. 30 days' written notice and a chance to cure, with an express written statement, before any action; no sunset.

    Section: IC 24-15-10-3

  4. No private right of action.

    Section: IC 24-15-10-4

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Indiana statute

Reference material, not legal advice.