Overview
The Indiana Consumer Data Protection Act (INCDPA) is a comprehensive data privacy law that grants Indiana residents new rights over their personal data while setting clear obligations for businesses. Signed into law on May 1, 2023, the INCDPA takes effect on January 1, 2026.
The law is closely modeled after Virginia’s CDPA and Colorado’s CPA, making it a business-friendly privacy framework with strong consumer protections but no private right of action.
Who Must Comply?
The INCDPA applies to businesses that operate in Indiana or target Indiana residents and meet one of the following criteria:
✔ Process personal data of at least 100,000 Indiana consumers annually
✔ Process personal data of at least 25,000 Indiana consumers and derive 50%+ of revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government agencies
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities (healthcare providers, insurers)
🚫 Higher education institutions
Key Consumer Rights Under INCDPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to inaccurate personal data.
✔ Right to Delete – Consumers can request the deletion of personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Automated profiling that affects legal or financial decisions
📌 No Private Right of Action – Unlike California’s CPRA, consumers cannot sue businesses directly for violations.
Business Compliance Requirements
✔ Universal Opt-Out Mechanism (Starting January 1, 2026) – Businesses must recognize Global Privacy Control (GPC) signals.
✔ Opt-In Consent for Sensitive Data Processing – Businesses must obtain explicit consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Biometric data
📌 Health conditions
📌 Children’s data
✔ Privacy Policy & Transparency – Companies must publish detailed privacy policies explaining data collection and usage.
✔ Data Security & Protection – Businesses must implement reasonable safeguards to protect personal data.
✔ Risk Assessments for High-Risk Processing – Companies must conduct Data Protection Assessments (DPA) for:
📌 Targeted advertising
📌 Data sales
📌 AI-driven automated decision-making
Real-World Enforcement Cases
The Indiana Attorney General enforces the INCDPA, with penalties of up to $7,500 per violation.
📌 30-Day Cure Period for Violations – Before fines are imposed, businesses have 30 days to fix compliance issues.
Since INCDPA does not take effect until January 1, 2026, major enforcement cases have not yet occurred, but businesses failing to provide opt-out mechanisms or proper security measures are likely to be early enforcement targets.
📌 Comparison with Other State Privacy Laws
The Indiana INCDPA is more flexible for businesses than California’s CPRA but closely resembles Virginia’s CDPA:
✅ No Private Right of Action – Consumers cannot sue companies directly.
✅ Stronger Opt-Out Requirements – Businesses must honor universal opt-out signals in 2026.
✅ Less Strict Than CPRA – Indiana’s law has fewer compliance obligations than California’s CPRA.
Future of INCDPA Regulation
📌 Stronger enforcement expected in 2026, particularly for AI-driven profiling.
📌 Possible expansion of consumer rights in future amendments.
📌 Potential updates to align with federal privacy laws if enacted.
Indiana’s INCDPA is a consumer-friendly but business-oriented privacy law, balancing consumer rights with clear compliance measures.
