Indiana Consumer Data Protection Act (INCDPA)

Enacted privacy legislation following Virginia's CDPA model. Applies to businesses that control or process personal data of Indiana residents and meet specific thresholds. Requires data protection assessments for high-risk processing activities and establishes consumer rights including access, deletion, correction, and portability. Includes exemptions for data covered by federal regulations like HIPAA and GLBA. Enforcement through attorney general's office with maximum penalties of $7,500 per violation. Notable provisions include specific requirements for processing sensitive data and opt-out rights for targeted advertising.

JurisdictionIndiana
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Indiana Consumer Data Protection Act (INCDPA) establishes several key requirements for businesses:

  • Applicability thresholds: The law applies to businesses that control or process personal data of at least 100,000 Indiana consumers, or 25,000 consumers if deriving over 50% of gross revenue from selling personal data Indiana General Assembly
  • Consumer rights: Businesses must honor consumer rights including access, deletion, correction, and data portability Indiana Attorney General
  • Opt-out rights: Consumers have the right to opt out of targeted advertising, sale of personal data, and certain profiling activities Indiana General Assembly
  • Data protection assessments: Required for high-risk processing activities like targeted advertising and selling personal data Indiana General Assembly
  • Privacy notices: Businesses must provide clear privacy notices detailing data collection and processing practices Indiana General Assembly

Compliance Challenges

Organizations face several challenges in complying with the INCDPA:

  • Data mapping and inventory: Identifying and categorizing all personal data collected on Indiana residents IAPP Resource Center
  • Implementing consumer rights processes: Establishing systems to handle access, deletion, and correction requests TrustArc Blog
  • Consent management: Obtaining and managing explicit consent for sensitive data processing OneTrust DataGuidance
  • Data protection assessments: Conducting and documenting assessments for high-risk processing activities IAPP Resource Center

Implementation Best Practices

To implement INCDPA compliance effectively:

Recent Updates

The INCDPA was signed into law on May 1, 2023, with key updates including:

  • 30-day cure period: Businesses have 30 days to cure alleged violations before enforcement action Indiana Attorney General
  • No private right of action: Enforcement is solely through the Attorney General's office IAPP Resource Center

Related Regulations

The INCDPA interacts with several other privacy regulations:

  • General Data Protection Regulation (GDPR): INCDPA incorporates GDPR concepts like data protection assessments EU GDPR
  • Colorado Privacy Act: Shares similar requirements for opt-out rights and data protection assessments Colorado Privacy Act

Industry Impact

The INCDPA will significantly impact various industries:

Sources

Indiana General Assembly Indiana Attorney General IAPP Resource Center TrustArc Blog OneTrust DataGuidance Husch Blackwell Data Privacy Report IAPP Implementation Guide OneTrust Consent Management DataGrail Rights Automation NIST Privacy Framework IAPP Privacy Notice Generator ICO Data Minimisation Guidance Virginia Consumer Data Protection Act California Consumer Privacy Act EU GDPR Colorado Privacy Act National Retail Federation Privacy Report CompTIA State of Cybersecurity Report HIPAA Journal INCDPA Analysis American Bankers Association Privacy Resource

Recent developments

  • — Overview noting that the **Indiana Consumer Data Protection Act (INCDPA)**, passed in 2023, is now in effect as of January 1, 2026, granting Indiana residents rights to access, correct, delete, and obtain copies of their personal data and to opt out of targeted advertising, sale of data, and profiling.[5] (source)
  • — Law firm analysis highlights that Indiana’s INCDPA took effect January 1, 2026 alongside new Kentucky and Rhode Island laws, emphasizing new obligations for businesses such as clear privacy notices, opt-in consent for sensitive data, DPIAs for high‑risk processing, and AG enforcement with penalties up to $7,500 per violation.[6] (source)
  • — Client alert explains that **Indiana’s CDPA/INCDPA is now “live” as of January 1, 2026**, detailing consumer rights (know, correct, delete, portability, and opt‑out of selling/targeted ads) and stressing compliance steps such as updating privacy policies, honoring requests within 45 days, and preparing for AG enforcement without a private right of action.[3] (source)
  • — Indiana Attorney General publishes a **Consumer Data Protection Bill of Rights** flyer outlining 15 key rights under the INCDPA effective January 1, 2026, including rights to access, delete, correct, portability, and opt out of targeted advertising, sale of personal data, and profiling, as well as how to file complaints with the AG.[4] (source)
  • — Commentary notes the AG’s release of the Consumer Data Protection Bill of Rights and explains applicability thresholds (100,000 consumers or 25,000 plus 50% revenue from data sales), exclusions (nonprofits, higher education, HIPAA‑regulated entities), response timelines (45 days + 45‑day extension), and enforcement risks (up to $7,500 per violation, no private right of action).[7] (source)
  • — Industry explainer describes INCDPA’s scope and obligations ahead of and after its January 1, 2026 effective date, including DPIA requirements for targeted advertising, sale of data, profiling with foreseeable risk, and sensitive data processing, and notes that the law closely tracks Virginia/Colorado‑style privacy regimes, influencing multi‑state compliance strategies.[1] (source)
  • — Law firm blog reminds organizations that Indiana’s comprehensive privacy law (INCDPA/ICDPA) took effect January 1, 2026 and urges companies meeting the thresholds to finalize compliance programs, align notices and contracts with other state privacy laws, and prepare for Indiana AG oversight.[2] (source)
  • — Consumer‑oriented update emphasizes that as of **January 1, 2026**, Hoosiers can exercise new INCDPA rights against covered businesses, and it compares INCDPA’s Virginia‑style model to other state privacy laws to help industry understand interoperability and where Indiana is more or less stringent.[5] (source)
  • — Privacy Rights Clearinghouse publishes an overview noting that the Indiana Consumer Data Protection Act, passed in 2023, took effect on January 1, 2026, granting Indiana residents rights to access, correct, delete, and opt out of sale and targeted advertising of their personal data.[4] (source)
  • — Indiana Attorney General Todd Rokita announces that the Indiana Consumer Data Protection Act is now in effect as of January 1, 2026, signaling the start of enforcement of the state’s comprehensive consumer privacy regime.[6] (source)
  • — Hunton Andrews Kurth summarizes the impending effective date of the Indiana Consumer Data Protection Act on January 1, 2026, highlighting business‑friendly features such as a permanent 30‑day cure period, high applicability thresholds, limited sensitive data definition, and absence of AG rulemaking authority.[2] (source)
  • — The same Hunton Andrews Kurth analysis notes that, ahead of the effective date, the Indiana Attorney General’s Office has published a Consumer Bill of Rights to guide residents and businesses on their rights and obligations under the Act, effectively serving as key interpretive and compliance guidance in lieu of formal regulations.[2] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates