Indiana Consumer Data Protection Act INCDPA-Controller-PrivacyNotice-PurposeLimitation-DataMinimisation-Transparency-LawfulBasis: Indiana CDPA Controller Obligations - Privacy Notice + Purpose Limitation + Data Minimisation + Transparency + Lawful Basis + Reasonable + Adequate + Relevant + Limited to What is Necessary
Per IC 24-15-4 controllers operating subject to INCDPA must comply with five core obligations. (1) Privacy Notice (IC 24-15-4-1): controller shall provide consumers with a reasonably accessible + clear + and meaningful privacy notice that includes (a) the categories of personal data processed by the controller; (b) the purpose for processing personal data; (c) how consumers may exercise their consumer rights including how a consumer may appeal a controller decision with regard to a consumer request; (d) the categories of personal data that the controller shares with third parties if any; (e) the categories of third parties if any with which the controller shares personal data; (f) an active email address or other online mechanism that the consumer may use to contact the controller. If a controller sells personal data to third parties or processes personal data for targeted advertising the controller shall clearly and conspicuously disclose such processing and the manner in which a consumer may exercise the right to opt out of such processing. (2) Purpose Limitation (IC 24-15-4-2): controller shall limit the collection of personal data to what is adequate + relevant + and reasonably necessary in relation to the purposes for which the data is processed as disclosed to the consumer. (3) Data Minimisation (IC 24-15-4-3): controller shall not process personal data for purposes that are neither reasonably necessary to nor compatible with the disclosed purposes for which such personal data is processed as disclosed to the consumer unless the controller obtains the consumer consent. (4) Lawful Processing (IC 24-15-4-4): controller shall not process personal data in violation of state or federal laws that prohibit unlawful discrimination against consumers. (5) Reasonable Security (IC 24-15-4-5): controller shall establish + implement + and maintain reasonable administrative + technical + and physical data security practices to protect the confidentiality + integrity + and accessibility of personal data appropriate to the volume and nature of the personal data at issue (similar to FTC reasonable security standard + GLBA Safeguards Rule + HIPAA Security Rule + NIST CSF). (6) Non-Discrimination (IC 24-15-4-6): controller shall not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers and shall not discriminate against a consumer for exercising any of the consumer rights including denying goods or services + charging different prices or rates for goods or services + providing a different level of quality of goods or services. Coordinates with FTC Act Section 5 + FTC Reasonable Security + state UDAP (Unfair or Deceptive Acts or Practices) + similar state privacy laws + GDPR Art 5 + DPDP Sec 8 + COPPA. INCDPA Controller Obligations applies.
What else in your programme already covers this
This control maps to 174 controls across 49 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.