Indiana Consumer Data Protection Act (INCDPA) Assessment

INCDPA applies to organizations that conduct business in Indiana or offer products or services specifically targeted to Indiana residents. The law uses an Indiana-resident threshold test tied to consumer counts and sale-of-data revenue.

INCDPA generally applies if your organization controls or processes personal data of at least 100,000 Indiana consumers in a calendar year, or controls or processes personal data of at least 25,000 Indiana consumers and derives more than 50% of gross revenue from the sale of personal data.

INCDPA includes exemptions for certain public bodies, Gramm-Leach-Bliley Act (GLBA)-regulated financial institutions and affiliates, Health Insurance Portability and Accountability Act (HIPAA) covered entities and business associates, nonprofits, institutions of higher education, public utilities and affiliated service companies, and several categories of exempt data such as Health Insurance Portability and Accountability Act (HIPAA), research, Fair Credit Reporting Act (FCRA), Family Educational Rights and Privacy Act (FERPA), Driver's Privacy Protection Act (DPPA), Farm Credit Act, employment, and emergency-contact data.

You should conduct regular data mapping to track what personal data is collected, where it is stored, how it flows, who can access it, and what safeguards apply. Maintaining an accurate inventory supports compliance, data governance, and breach response.

INCDPA defines sensitive data to include racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, personal data collected from a known child, and precise geolocation data. Classification helps operationalize the law’s stricter requirements.

INCDPA is structured around controller duties. Your organization must document its legal basis for processing, specifically ensuring that consent is obtained prior to processing sensitive data and that clear notice and opt-out mechanisms are provided for targeted advertising, sales of personal data, and profiling.

INCDPA requires consent before processing sensitive data, and processing sensitive data concerning a known child must be done in accordance with the Children's Online Privacy Protection Act (COPPA). Consent should be a clear affirmative action on the consumer's behalf that is freely given, specific, informed, and unambiguous agreement to process their personal data.

INCDPA requires a privacy notice that includes categories of personal data processed, purposes, how consumers exercise rights and appeal, categories of personal data shared with third parties, and categories of third parties. It also requires secure and reasonable means for consumers to submit requests.

INCDPA gives consumers rights to confirm and access, correct inaccuracies, delete personal data, obtain portable copies, and opt out of targeted advertising, the sale of personal data, and certain profiling. Controllers generally must respond within 45 days, with one possible 45-day extension, and must provide an appeal process with a decision generally within 60 days.

INCDPA requires controllers to establish, implement, and maintain reasonable administrative, technical, and physical security practices appropriate to the volume and nature of the personal data at issue.

INCDPA requires data protection impact assessments for targeted advertising, the sale of personal data, certain profiling, sensitive-data processing, and other processing activities presenting a heightened risk of harm. The assessment obligation applies to processing activities created or generated starting December 31, 2025.

Organizations using de-identified data should take reasonable measures to prevent re-identification, publicly commit not to re-identify, contractually bind recipients, and exercise oversight over downstream commitments.

INCDPA requires processor contracts to address instructions, purpose, type of data, duration, rights and obligations, confidentiality, deletion or return, information-sharing, assessments, and subcontractor controls.

Indiana’s consumer privacy law should be paired operationally with Indiana’s breach-notification law. Indiana generally requires notice without unreasonable delay and not later than 45 days after discovery, subject to specified exceptions, and also requires notice to the Indiana Attorney General when resident notice is required.

Documentation matters for defensibility and investigation response. Indiana’s law is enforced exclusively by the Attorney General, includes a 30-day cure period, and allows civil penalties of up to $7,500 per violation if issues are not cured.