Law / United States / 
Indiana
Indiana Consumer Data Protection Act (INCDPA), publicly available information exemption
Ind. Code Art. 24-15 (Senate Enrolled Act 5, 2023)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- on_request
What it requires
- Personal data that is lawfully made available through a government record, or that a consumer or widely distributed media has lawfully made available to the public, falls outside the INCDPA's definition of personal data, unless the consumer has restricted it to a specific audience.
- If you meet the INCDPA's 100,000-consumer threshold, expect enforcement only from the Indiana Attorney General; the Act carries no private right of action.
These lines are LexLint's reading of the law's text. Also read by: Office of the Indiana Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection-Consumer-Bill-of-Rights_Web.pdf
- Guidance body
- Office of the Indiana Attorney General
- Open questions
- What facts show that a business has a 'reasonable basis to believe' that information is 'lawfully made available' to the general public through widely distributed media under IC 24-15-2-26?
- Is information 'lawfully made available' under IC 24-15-2-26 when the page that carries it prohibits automated collection in its terms of use?
- Does a consumer who limits a post to registered users of a platform thereby fall within 'unless the consumer has restricted the information to a specific audience' under IC 24-15-2-26?
What it makes you log
Who may demand the log
Regulator
Logging duty
A controller must conduct and document a data protection impact assessment of targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of injury to consumers, the processing of sensitive data and any other processing that presents a heightened risk of harm, weighing the benefits of the processing against the risks to the consumer (IC 24-15-6-1(b) and (c)). The requirement applies to processing activities created or generated after (IC 24-15-6-1(a)). The Attorney General may request, through a civil investigative demand, any assessment relevant to an investigation, and the controller must make it available; assessments are confidential and exempt from public inspection (IC 24-15-6-2). A controller-processor contract must also require the processor to make available, on the controller's reasonable request, all information necessary to demonstrate its compliance (IC 24-15-5-2(a)(3)). The row's scraping-specific text is the exclusion of publicly available information from personal data in IC 24-15-2-19 and IC 24-15-2-26, which states no record duty; these duties bind a scraper that is a controller within IC 24-15-1-1. No retention period is stated.
- Kind
- Implicit
- As of
- Provision
- Ind. Code § 24-15-6-1(b) and § 24-15-6-2(a)
- Trigger
- personal_data_processing
What this law does
IC 24-15-2-19(b) defines personal data to exclude de-identified data, aggregate data, or publicly available information.
IC 24-15-2-26 defines publicly available information as information that is lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer to whom the information pertains, or by a person to whom the consumer has disclosed it, unless the consumer has restricted the information to a specific audience.
The exclusion removes information lawfully made available through government records or widely distributed media from the definition of personal data itself, rather than exempting it by a separate carve-out.
IC 24-15-1-1(a) applies the Act to a person conducting business in Indiana or targeting Indiana residents that, during a calendar year, controls or processes personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than half of its gross revenue from selling personal data. Enforcement is Attorney-General-only; there is no private right of action.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .