Does Indiana have a comprehensive privacy law? Yes. The Indiana Consumer Data Protection Act (Senate Enrolled Act 5 of 2023) took effect on January 1, 2026.
- Status: In Effect
- Law: Indiana Consumer Data Protection Act (SEA 5, 2023; Ind. Code art. 24-15)
- Signed: Not yet verified (2023) · Effective: January 1, 2026
- Applies to: Persons that conduct business in Indiana or produce products or services targeted to Indiana residents and that, during a calendar year, control or process the personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than 50% of gross revenue from the sale of personal data
- Cure period: Yes; 30 days after the Attorney General’s written notice; the act sets no end date
- Enforcement: Indiana Attorney General (exclusive); injunction and civil penalties of up to $7,500 per violation, plus investigation costs and attorney’s fees
- Last verified: November 4, 2026 · Official source: SEA 5 enrolled act (Indiana General Assembly)
- Related: What the Indiana Consumer Data Protection Act means for your company
The Indiana Consumer Data Protection Act gives Indiana residents the right to confirm whether a controller processes their personal data, to get a copy or summary of it once a year free of charge, to correct and delete it, and to opt out of targeted advertising, the sale of personal data and profiling. Controllers must get consent before processing sensitive data, give a clear privacy notice, and document data protection impact assessments for targeted advertising, sales of personal data, certain profiling and sensitive data.
The Indiana Attorney General enforces the law and has published a Consumer Bill of Rights explaining it. For what the law means for businesses, see our Indiana Consumer Data Protection Act guide.