Indiana Consumer Data Protection Act (ICDPA)
In force Indiana · In force Jan 1, 2026 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Virginia-style comprehensive privacy law granting rights to confirm, access, correct, delete, obtain a copy of, and opt out of targeted advertising, sale and profiling. Requires consent for sensitive data processing and data protection impact assessments for high-risk processing.
- Who it applies to
- Persons doing business in Indiana or targeting Indiana residents that during a calendar year control or process personal data of 100,000+ Indiana consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- Penalties
- Civil penalty up to $7,500 per violation plus injunctive relief. Permanent 30-day cure period (no sunset): AG must give 30 days' written notice and may not sue if the violation is cured.
- Enforced by
- Indiana Attorney General (exclusive)
- Official name
- Indiana Consumer Data Protection Act (SEA 5, 2023), Ind. Code 24-15
- Citation
- Senate Enrolled Act 5 (2023), P.L. 94-2023; Ind. Code 24-15-1 to 24-15-11
- Topics
- privacy
Verified 2026-09-22 iapp.org
Research notes
Official Indiana legislature pages are JavaScript-rendered and could not be text-extracted during verification; thresholds, $7,500 penalty and permanent 30-day cure are consistent with IAPP and law-firm trackers. The cure period has no sunset, so there is no cure-expiry deadline. No 2025-2026 amendments confirmed.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Indiana Consumer Data Protection Act (ICDPA)
- What are the Indiana Consumer Data Protection Act (ICDPA) compliance deadlines?
- Jan 1, 2026: ICDPA takes effect.
- When does Indiana Consumer Data Protection Act (ICDPA) take effect?
- Indiana Consumer Data Protection Act (ICDPA) took effect on Jan 1, 2026.
- Who does Indiana Consumer Data Protection Act (ICDPA) apply to?
- Persons doing business in Indiana or targeting Indiana residents that during a calendar year control or process personal data of 100,000+ Indiana consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- What are the penalties under Indiana Consumer Data Protection Act (ICDPA)?
- Civil penalty up to $7,500 per violation plus injunctive relief. Permanent 30-day cure period (no sunset): AG must give 30 days' written notice and may not sue if the violation is cured.