DPO SchoolDPO School

Indiana Consumer Data Protection Act

Indiana privacy law (ICDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must follow the controller's instructions and help it meet its duties. A binding contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance, assessments (or an independent assessment) and subcontractor flow-down.

Key points

  1. Processors must follow instructions and assist the controller.

    Section: IC 24-15-5-1

  2. Contract must set out instructions, nature and purpose, data types, duration, and the rights and obligations of both parties.

    Section: IC 24-15-5-2(a)

  3. Required terms: confidentiality, deletion or return, information to show compliance, assessments by the controller or an independent assessor, and written subcontracts.

    Section: IC 24-15-5-2(a)(1)-(5)

  4. Whether a person is a controller or processor is a fact-based question.

    Section: IC 24-15-5-3

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Indiana statute

Reference material, not legal advice.