As of the start of 2026, Indiana is among the 20 states with active data privacy legislation aimed at protecting consumers’ personal data and keeping consumers informed about how their data is being used. The Indiana Consumer Data Protection Act (INCDPA) was enacted on May 1, 2023, and became effective on January 1, 2026.
Here’s what business owners need to know about consumer rights created under the INCDPA:
- Right to Know: Consumers have a right to know whether a business is processing their personal data and request access to that data. This means that a consumer can request that a business disclose what personal data is collected, used, and disclosed to certain third parties, and obtain a copy.
- Right to Control: This right encompasses the rights to correction, deletion, and portability of personal data. Under the broad right to control, a consumer can request that data they previously provided to a business be corrected to address inaccuracies, deleted, or, where possible, provided to the consumer in a format that allows the data to be moved to a different platform.
- Right to Protect: Consumers have a right to opt out of the processing of their personal data for targeted marketing and profiling purposes. Where businesses sell data, consumers also have the right to opt out of the sale of their personal data. The right to protect also gives consumers the right to give consent prior to the processing of their sensitive personal data.
- Right to Take Action: Consumers have a right to exercise their rights under the INCDPA without a business discriminating against them for doing so, and can appeal a business’s decision to refuse an INCDPA rights request.
The INCDPA currently applies to businesses that:
- Conduct business in Indiana, or produce products or services targeted at Indiana residents, and
- During a calendar year, either
- Control or process data of at least 100,000 consumers who are Indiana residents, or
- Control or process data of at least 25,000 consumers who are Indiana residents and derive more than 50% of gross revenue from selling personal data.
While your business may not currently fall within these thresholds, it is important to stay up-to-date on new legislation impacting the INCDPA. Other states have lower or differing thresholds than those of the INCDPA, and your business may be obligated to comply with those state laws if you process information from individuals located in those states.
It is also very important that businesses provide consumers with a privacy policy to put consumers on notice about business practices related to personal data and certain rights under the INCDPA or other state laws. Businesses should ensure their data protection and use practices are limited in scope to what’s necessary to fulfill the purposes stated within the policy. Most critical is that your privacy policy is an accurate reflection of what data is collected and how it’s used.
If you need help understanding rights and responsibilities under the INCDPA, contact Gutwein Law at 765.423.7900.
