Indiana Consumer Data Protection Act
Indiana's comprehensive consumer privacy law (IC 24-15, in force since 1 January 2026): rights to confirm and access, correct, delete, obtain a portable copy and opt out of targeted advertising, sale and significant profiling, answered within 45 days with appeals; consent for sensitive data; data minimisation, purpose limitation and security; a privacy notice; processor contracts; and data protection impact assessments, enforced by the Attorney General with a permanent 30-day cure. Built from the official Indiana Code 2026 text, read in full, including the 2025 amendment.
Indiana Consumer Data Protection Act is a compliance framework from United States - Indiana with 5 domains and 31 controls that map to 95 other frameworks. The largest domains are Consumer rights and how controllers answer requests (IC 24-15-3) – Indiana Consumer Data Protection Act (12 controls), Controller duties, privacy notice and request methods (IC 24-15-4) – Indiana Consumer Data Protection Act (9 controls), De-identified and pseudonymous data; processing under an exemption (IC 24-15-7 and 24-15-8-7) – Indiana Consumer Data Protection Act (4 controls). Every control below carries what it requires and what an assessor expects to see.
Framework summaries on this platform are interpretations grounded in the published source, for educational and compliance planning purposes. They do not reproduce or replace the official standards. Refer to the authoritative source for the definitive text. Framework names and trademarks belong to their respective organisations.
Framework Domains (5)
Consumer rights and how controllers answer requests (IC 24-15-3) – Indiana Consumer Data Protection Act
| Code | Title |
|---|---|
| indiana-consumer-data-protection-act::24-15-3-1-a | IC 24-15-3-1(a) Requests by a parent or legal guardian for a known child |
| indiana-consumer-data-protection-act::24-15-3-1-b1 | IC 24-15-3-1(b)(1) Right to confirm processing and access personal data |
| indiana-consumer-data-protection-act::24-15-3-1-b2 | IC 24-15-3-1(b)(2) Right to correct inaccuracies in data the consumer provided |
| indiana-consumer-data-protection-act::24-15-3-1-b3 | IC 24-15-3-1(b)(3) Right to delete personal data provided by or obtained about the consumer |
| indiana-consumer-data-protection-act::24-15-3-1-b4 | IC 24-15-3-1(b)(4) Portable copy or representative summary of data the consumer provided |
| indiana-consumer-data-protection-act::24-15-3-1-b5 | IC 24-15-3-1(b)(5) Right to opt out of targeted advertising, sale and significant profiling |
| indiana-consumer-data-protection-act::24-15-3-1-c1 | IC 24-15-3-1(c)(1) Respond within 45 days, one 45-day extension with notice |
| indiana-consumer-data-protection-act::24-15-3-1-c2 | IC 24-15-3-1(c)(2) Explain a refusal and give appeal instructions within 45 days |
| indiana-consumer-data-protection-act::24-15-3-1-c3 | IC 24-15-3-1(c)(3) Free of charge once a year; fees only for unfounded, excessive or repetitive requests |
| indiana-consumer-data-protection-act::24-15-3-1-c4 | IC 24-15-3-1(c)(4) Authentication with commercially reasonable efforts |
| indiana-consumer-data-protection-act::24-15-3-1-c5 | IC 24-15-3-1(c)(5) Deletion of data obtained from third parties through a suppression record |
| indiana-consumer-data-protection-act::24-15-3-1-d | IC 24-15-3-1(d) Appeal process decided within 60 days with a route to the attorney general |
Controller duties, privacy notice and request methods (IC 24-15-4) – Indiana Consumer Data Protection Act
| Code | Title |
|---|---|
| indiana-consumer-data-protection-act::24-15-4-1-1 | IC 24-15-4-1(1) Limit collection to what is adequate, relevant and reasonably necessary |
| indiana-consumer-data-protection-act::24-15-4-1-2 | IC 24-15-4-1(2) No processing for incompatible purposes without consent |
| indiana-consumer-data-protection-act::24-15-4-1-3 | IC 24-15-4-1(3) Reasonable administrative, technical and physical data security |
| indiana-consumer-data-protection-act::24-15-4-1-4 | IC 24-15-4-1(4) No unlawful discrimination and no retaliation for exercising rights |
| indiana-consumer-data-protection-act::24-15-4-1-5 | IC 24-15-4-1(5) Consent before processing sensitive data; COPPA for a known child |
| indiana-consumer-data-protection-act::24-15-4-2 | IC 24-15-4-2 No contract terms that waive or limit consumer rights |
| indiana-consumer-data-protection-act::24-15-4-3 | IC 24-15-4-3 Reasonably accessible, clear and meaningful privacy notice |
| indiana-consumer-data-protection-act::24-15-4-4 | IC 24-15-4-4 Clear and conspicuous disclosure of sale and targeted advertising, with the opt-out |
| indiana-consumer-data-protection-act::24-15-4-5 | IC 24-15-4-5 Secure and reliable request methods without a new account |
Data protection impact assessments (IC 24-15-6) – Indiana Consumer Data Protection Act
| Code | Title |
|---|---|
| indiana-consumer-data-protection-act::24-15-6-1-b | IC 24-15-6-1(a) and (b) Conduct and document assessments of heightened-risk processing |
| indiana-consumer-data-protection-act::24-15-6-1-c | IC 24-15-6-1(c) to (e) Weigh benefits against risks as mitigated by safeguards |
| indiana-consumer-data-protection-act::24-15-6-2 | IC 24-15-6-2 Provide assessments to the attorney general on a civil investigative demand |
De-identified and pseudonymous data; processing under an exemption (IC 24-15-7 and 24-15-8-7) – Indiana Consumer Data Protection Act
| Code | Title |
|---|---|
| indiana-consumer-data-protection-act::24-15-7-1-a | IC 24-15-7-1(a) Duties of a controller holding de-identified data |
| indiana-consumer-data-protection-act::24-15-7-2 | IC 24-15-7-2 Pseudonymous data carve-out requires separation under effective controls |
| indiana-consumer-data-protection-act::24-15-7-3 | IC 24-15-7-3 Oversight of disclosed pseudonymous or de-identified data |
| indiana-consumer-data-protection-act::24-15-8-7 | IC 24-15-8-7 Processing under an exemption must be necessary, proportionate, limited and secured |
Processors and controller-processor contracts (IC 24-15-5) – Indiana Consumer Data Protection Act
| Code | Title |
|---|---|
| indiana-consumer-data-protection-act::24-15-5-1 | IC 24-15-5-1 Processor follows instructions and assists the controller |
| indiana-consumer-data-protection-act::24-15-5-2-a | IC 24-15-5-2(a)(1) to (4) Binding controller-processor contract with required terms |
| indiana-consumer-data-protection-act::24-15-5-2-a5 | IC 24-15-5-2(a)(5) and (b) Subcontractors bound by written contract; liability unchanged |
Your Compliance Coverage
If you comply with Indiana Consumer Data Protection Act, you already cover:
Privacy Act 1988 (Australia)
15%
6 controls mapped
Compare →Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP)
15%
6 controls mapped
Compare →Law No. 172-13 on the Protection of Personal Data
15%
6 controls mapped
Compare →+ 92 more: Iowa Consumer Data Protection Act (15%), Indonesia PDP Law (15%)
See all 95 mapped frameworks ↓Maps to 95 other frameworks
Coverage is not the same as your position
This page shows what Indiana Consumer Data Protection Act overlaps with in general. Where your organisation actually stands, against the standard you are going for and the certifications you already hold, is a different question. Same graph and the same recorded refutations, scoped to you rather than to a pair.
The Compliance Position Diagnostic, $5,000 fixed, ten business daysWhat is Indiana Consumer Data Protection Act and who does it apply to?
Indiana Consumer Data Protection Act is a compliance framework from United States - Indiana with 5 domains and 31 controls. Indiana's comprehensive consumer privacy law (IC 24-15, in force since 1 January 2026): rights to confirm and access, correct, delete, obtain a portable copy and opt out of targeted advertising, sale and significant profiling, answered within 45 days with appeals; consent for sensitive data; data minimisation, purpose limitation and security; a privacy notice; processor contracts; and data protection impact assessments, enforced by the Attorney General with a permanent 30-day cure. Built from the official Indiana Code 2026 text, read in full, including the 2025 amendment. It is used by organisations to establish and maintain compliance with industry standards and regulatory requirements.
What does Indiana Consumer Data Protection Act actually require?
Indiana Consumer Data Protection Act has 31 controls organised across 5 domains. The largest domains are Consumer rights and how controllers answer requests (IC 24-15-3) – Indiana Consumer Data Protection Act (12 controls), Controller duties, privacy notice and request methods (IC 24-15-4) – Indiana Consumer Data Protection Act (9 controls), De-identified and pseudonymous data; processing under an exemption (IC 24-15-7 and 24-15-8-7) – Indiana Consumer Data Protection Act (4 controls). Each control defines specific requirements that organisations must implement to achieve compliance.
If I already comply with another framework, how much of Indiana Consumer Data Protection Act do I already cover?
Indiana Consumer Data Protection Act maps to 95 other compliance frameworks. The top mapping partners are Privacy Act 1988 (Australia) (15% coverage), Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) (15% coverage), Law No. 172-13 on the Protection of Personal Data (15% coverage). Use our comparison tool to explore control-level mappings between frameworks.
How do I implement Indiana Consumer Data Protection Act?
Start your Indiana Consumer Data Protection Act compliance journey by running a self-assessment on our platform to identify your current compliance posture. Our AI advisory can answer specific questions about Indiana Consumer Data Protection Act requirements, and cross-framework mapping helps you leverage existing controls from other frameworks you may already comply with. Create a free account to access all 31 controls and track your progress.
Start Your Compliance Journey
Create a free account to run self-assessments, get AI advisory, and track your compliance progress across 1,121 frameworks.
Get Started Free →Free forever, no credit card required