Law / United States / 
Indiana
Indiana Consumer Data Protection Act (INCDPA), general applicability and controller duties
Ind. Code §§ 24-15-1-1, 24-15-4-1, 24-15-11-1
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Determine whether you conduct business in Indiana, or produce a product or service targeted to Indiana residents, and control or process the personal data of at least 100,000 Indiana consumers, or at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data, before relying on INCDPA's scope in compliance planning.
- Limit the collection of personal data from an Indiana consumer to what is adequate, relevant, and reasonably necessary for the purposes disclosed to that consumer, and do not process it for an incompatible purpose without consent.
- Do not rely on a local Indiana ordinance to vary INCDPA. Article 15 preempts city, county, and other local law on the processing of personal data.
These lines are LexLint's reading of the law's text. Also read by: Office of the Indiana Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.in.gov/attorneygeneral/files/Consumer_Data-Bill-of-Rights.pdf
- Guidance body
- Office of the Indiana Attorney General
- Open questions
- Does the exemption in Ind. Code § 24-15-1-1(b)(2) for 'financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act' reach an affiliate's processing of data that is not itself subject to Title V, or only the data Title V covers?
What it makes you log
Logging duty
Section 24-15-4-1 requires a controller to limit collection to what is reasonably necessary for the disclosed purposes, to obtain consent for an incompatible purpose, and to maintain reasonable administrative, technical and physical data security practices. Section 24-15-1-1 sets the scope and 24-15-11-1 preempts local law. None of the three requires a log or a record of processing, sets a retention period or gives a regulator a right to a record. The data protection impact assessment duty is in IC 24-15-6, which this row does not cite. The scope clause names both an Indiana business and a product or service targeted to Indiana residents.
- Kind
- None
- As of
What this law does
INCDPA governs private-sector processing of Indiana residents' personal data. It applies to a person conducting business in Indiana, or producing a product or service targeted to Indiana residents, that during a calendar year controls or processes the personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data.
A controller must limit collection to what is adequate, relevant, and reasonably necessary for the purposes disclosed to the consumer, and may not process personal data for an incompatible purpose without the consumer's consent. Article 15 also preempts local law: no city, county, or other local government may regulate a controller's or processor's processing of personal data.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .