HomeLegal DirectoryIndiana Consumer Data Protection Act

In effect Limited protection

Indiana Consumer Data Protection Act (ICDPA)

Indiana · 2023 Ind. Acts P.L. 94-2023 (SB 5); I.C. 24-15-1 et seq.

Indiana's privacy law, effective January 1, 2026, gives residents rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, data sales, and profiling. Enforced exclusively by the Attorney General with a permanent 30-day cure period.

Technical detail

Indiana SB 5 (P.L. 94-2023), I.C. 24-15-1 et seq., eff. Jan. 1, 2026; VCDPA-modeled; permanent 30-day cure; 100,000-consumer or 25,000/50%-revenue thresholds.

Who is protected: Indiana residents

Who must comply: Controllers meeting thresholds

Key facts

JurisdictionIndiana
LevelState
StatusIn effect
Protection strengthLimited protection
Effective date2026-01-01
Enacted2023-05-01
Citation2023 Ind. Acts P.L. 94-2023 (SB 5); I.C. 24-15-1 et seq.
Enforced byIndiana Attorney General
Private right of actionNo — agency enforcement only
PenaltiesCivil penalties via AG after 30-day cure
Topicsconsumer data privacy · data retention · consumer protection · automated decision-making
Last verified2026-06-12
Official sourceIndiana SB 5 — Consumer Data Protection (Indiana General Assembly) ↗

More AI rules in Indiana

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.