Navigating the Indiana Consumer Data Protection Act (ICDPA): Key Details

Indiana became the seventh U.S. state to enact its own data protection law, the Indiana Consumer Data Protection Act (ICDPA). The law, closely modeled on Virginia's Consumer Data Protection Act (VCDPA), will take effect on January 1, 2026.

Sponsored by Senator Liz Brown, Senate Bill 5 (SB 5) passed unanimously in the Senate (49-0) in February 2023. After amendments, it was approved by the House and signed into law by Governor Eric Holcomb on May 1, 2023. The ICDPA establishes robust consumer data privacy rights and imposes strict obligations on organizations handling consumer data.

The ICDPA mandates organizations to comply with several key obligations, including purpose limitation, non-discrimination, implementing security measures, obtaining consent, providing privacy notices, and conducting data protection impact assessments. It also provides consumers rights such as access, correction, deletion, data portability, disclosure, and the ability to opt-out of certain data processing activities.