Indiana Consumer Data Protection Act

Indiana Consumer Data Protection Act (ICDPA)
Indiana · 2023 Ind. Acts P.L. 94-2023 (SB 5); I.C. 24-15-1 et seq.

Status
In effect
Took effect
January 1, 2026
Applies to
Controllers meeting thresholds
Enforced by
Indiana Attorney General

Indiana's privacy law, effective January 1, 2026, gives residents rights to access, correct, delete, and port personal data, and to opt out of targeted advertising, data sales, and profiling. Enforced exclusively by the Attorney General with a permanent 30-day cure period.

Who is protected: Indiana residents

Legal detail

Indiana SB 5 (P.L. 94-2023), I.C. 24-15-1 et seq., eff. Jan. 1, 2026; VCDPA-modeled; permanent 30-day cure; 100,000-consumer or 25,000/50%-revenue thresholds.

Key facts

JurisdictionIndiana
LevelState
StrengthLimited
EnactedMay 1, 2023
Citation2023 Ind. Acts P.L. 94-2023 (SB 5); I.C. 24-15-1 et seq.
Private right of actionNo, agency enforcement only
PenaltiesCivil penalties via AG after 30-day cure
Topicsconsumer data privacy · data retention · consumer protection · automated decision-making
Bill textIndiana SB 5 — Consumer Data Protection (Indiana General Assembly)

More AI rules in Indiana

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.