Makes public services decisions, in Indiana

Ind. Code § 24-15-3-1 · Read the law's page

• Give an Indiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
• Offer an Indiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
• Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available when reasonably necessary, and inform the consumer within that period of any extension and its reason.

Ind. Code §§ 24-15-6-1, 24-15-6-2 · Read the law's page

• Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
• Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
• Make an assessment available to the Attorney General when it is requested under a civil investigative demand as relevant to an investigation.
• Apply the assessment duty to processing activities created or generated after December 31, 2025, and not to earlier ones.

Ind. Code sec. 24-4.9-3-3.5 · Read the law's page

• This binds any 'data base owner' that owns or licenses computerized data including personal information of an Indiana resident. A data base owner already maintaining its own data security procedures as part of an information privacy, security policy, or compliance plan under the USA PATRIOT Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or HIPAA, and complying with that plan's own reasonable-procedures requirement, is exempt; a current or former health care provider that claimed the HIPAA-based exemption remains bound for personal information, including health records, if its own plan does not require, or is not implemented to provide, that protection once it stops being a HIPAA covered entity.
• Implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard from unlawful use or disclosure any personal information of Indiana residents you collect or maintain.
• Do not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable.
• There is no private right of action for a violation. A knowing or intentional failure to comply with either duty is a deceptive act, actionable only by the Indiana Attorney General, who may seek an injunction, a civil penalty of up to $5,000 per deceptive act, and reasonable investigation and litigation costs; a related series of acts or omissions constitutes one deceptive act.

Ind. Code secs. 24-4-14-1 to 24-4-14-8 · Read the law's page

• This binds any person (an individual, partnership, corporation, limited liability company or other organization) that holds a customer's personal information, other than state government and its political subdivisions, a unit and the county offices the chapter lists, and a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act; a person in the business of waste collection is bound only as to personal information it holds directly in connection with that business.
• Do not dispose of a customer's unencrypted, unredacted personal information, which means discarding or abandoning it in an area accessible to the public, without shredding, incinerating, mutilating, erasing or otherwise rendering it illegible or unusable.
• Treat personal information as redacted only if it has been altered or truncated so that no more than the last four digits of a driver's license number, state identification number or account number, or no more than five digits of a Social Security number, are accessible.