Indiana Consumer Data Protection Act (“ICDPA”) (Ind. Code § 24-15) (Effective January 1, 2026)

Indiana Consumer Data Protection Act (“INCDPA”)

OFFICIAL CITATION: Ind. Code §§ 24-15-1-1, et seq., Title 24, Article 15 – Consumer Data Protection.
ORIGINAL LEGISLATION: Senate Bill 5 (2023); Public Law 94-2023.
EFFECTIVE DATE: January 1, 2026.
STATUS: Enacted and operative; amended by subsequent legislation, including Public Law 236-2025, which modified the law’s applicability provisions.

 

SUMMARY:
The Indiana Consumer Data Protection Act (“INCDPA”) establishes consumer privacy rights and compliance requirements for covered organizations that conduct business in Indiana or offer products or services targeted to Indiana residents and meet specified personal-data processing thresholds.
The law provides consumers with rights involving access, correction, deletion, data portability, and the ability to opt out of targeted advertising, personal-data sales, and certain profiling activities. It also establishes requirements involving privacy notices, sensitive-data processing, data protection impact assessments, security safeguards, and contractual relationships between controllers and processors.
The INCDPA is enforced by the Indiana Attorney General and does not provide consumers with a private right of action. Covered organizations should review the current statutory provisions, applicable exemptions, and amendments when evaluating their Indiana privacy obligations.

 

OFFICIAL LEGAL SOURCES:
Last Reviewed: October 16, 2026

 

These materials were obtained directly from the State Government public websites and are posted here for your review and reference only.  No Claim to Original State Government Works.  This may not be the most recent version.  The State may have more current information.  We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to.  Please check the linked sources directly.