Indiana Consumer Data Protection Act

Controller duties, privacy notice and request methods (IC 24-15-4) – Indiana Consumer Data Protection Act

Indiana Consumer Data Protection Act 24-15-4-1-2: IC 24-15-4-1(2) No processing for incompatible purposes without consent

What does 24-15-4-1-2 require?

A controller must not process personal data for purposes that are neither reasonably necessary for nor compatible with the disclosed purposes unless it obtains the consumer's consent.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Controller duties, privacy notice and request methods (IC 24-15-4) – Indiana Consumer Data Protection Act

24-15-4-1-1 IC 24-15-4-1(1) Limit collection to what is adequate, relevant and reasonably necessary
24-15-4-1-3 IC 24-15-4-1(3) Reasonable administrative, technical and physical data security
24-15-4-1-4 IC 24-15-4-1(4) No unlawful discrimination and no retaliation for exercising rights
24-15-4-1-5 IC 24-15-4-1(5) Consent before processing sensitive data; COPPA for a known child
24-15-4-2 IC 24-15-4-2 No contract terms that waive or limit consumer rights
24-15-4-3 IC 24-15-4-3 Reasonably accessible, clear and meaningful privacy notice
24-15-4-4 IC 24-15-4-4 Clear and conspicuous disclosure of sale and targeted advertising, with the opt-out
24-15-4-5 IC 24-15-4-5 Secure and reliable request methods without a new account

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Indiana Consumer Data Protection Act controls