Regulations › US states › Indiana
ICDPA
Indiana Consumer Data Protection Act
WhenIn effect since 1 January 2026
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses processing data of 100,000+ Indiana consumers, or 25,000+ consumers with…
Universal opt-outNot required
Cure periodThe AG must give 30 days' written notice and no action may proceed if the violation is cured
Request deadlineControllers must respond within 45 days, extendable once by 45 days
Maximum penaltyCivil penalty up to $7,500 per violation, plus injunctions and investigation costs
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
Applies to businesses processing data of 100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.Ind. Code § 24-15-1-1(a) · source ↗
Enrolled text of SEA 5 (2023), P.L. 94-2023, read from a copy hosted by Troutman. No amendments enacted in 2025 or 2026 found; AG issued a Consumer Data Protection Bill of Rights in Nov. 2025.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, higher education and certain utilities.Ind. Code §§ 24-15-1-1(b), 24-15-1-2 · source ↗
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires opt-in consent.Ind. Code §§ 24-15-2-28, 24-15-4-1(5) · source ↗
Children and teens
1
A child is under 13; a known child's data is sensitive and needs COPPA parental consent. No teen-specific protections.Ind. Code §§ 24-15-2-6, 24-15-1-3 · source ↗
Data minimization
1
Collection must be adequate, relevant and reasonably necessary to disclosed purposes; incompatible secondary use needs consent.Ind. Code § 24-15-4-1(1)-(2) · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, obtain a portable copy or summary, and opt out of targeted ads, sale and significant profiling.Ind. Code § 24-15-3-1(b) · source ↗
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days.Ind. Code § 24-15-3-1(c) · source ↗
Appeals
2
Controllers must offer an appeal, answer within 60 days, and on denial give a way to contact the Attorney General.Ind. Code § 24-15-3-1(d) · source ↗
Universal opt-out
0
Not required; no universal opt-out mechanism provision.Ind. Code § 24-15-3-1 · source ↗
Business duties
Assessments
2
Assessments are required for targeted ads, sale, risky profiling, sensitive data and other heightened-risk processing; the AG may request them.Ind. Code §§ 24-15-6-1, 24-15-6-2 · source ↗
Applies to processing activities created or generated after December 31, 2025.
Processor contracts
2
Contract with instructions, data types, duration, confidentiality, return or deletion, compliance information, assessments and written subcontractor flow-down.Ind. Code § 24-15-5-2 · source ↗
Privacy notice
1
Notice must cover data categories, purposes, rights and appeals, and data shared with third parties; sale and targeted ads must be clearly disclosed.Ind. Code §§ 24-15-4-3, 24-15-4-4 · source ↗
Loyalty programs
1
General non-discrimination rule with a carve-out for bona fide loyalty, rewards and club card programs.Ind. Code § 24-15-4-1(4)(B) · source ↗
De-identified data
3
Deidentified data needs safeguards, a public no-reidentification commitment and contract flow-down; pseudonymous data is exempt from certain rights if kept separate.Ind. Code §§ 24-15-2-12, 24-15-7-1, 24-15-7-2 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including civil investigative demands.Ind. Code §§ 24-15-9-1, 24-15-10-1 · source ↗
Cure period
0
The AG must give 30 days' written notice and no action may proceed if the violation is cured; the cure right does not sunset.Ind. Code § 24-15-10-3 · source ↗
Maximum penalty
2
Civil penalty up to $7,500 per violation, plus injunctions and investigation costs.Ind. Code § 24-15-10-2(a) · source ↗
Rulemaking
0
No rulemaking authority; the AG may only publish a resource list for controllers.Ind. Code § 24-15-4-6 · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws