Law / United States / 
Indiana
Indiana Consumer Data Protection Act, Attorney General enforcement
Ind. Code §§ 24-15-10-1 to 24-15-10-4
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect INCDPA violations to be enforced exclusively by the Indiana Attorney General, never by a private plaintiff.
- Cure a noticed violation and provide a written attestation of the cure within 30 days of Attorney General notice to avoid a civil penalty of up to $7,500 per violation. Unlike some peer states, Indiana's 30-day cure right is mandatory and carries no expiration date in the statute.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a controller breach its express written statement under Ind. Code § 24-15-10-3(a)(2) that no further such violations will occur when it later violates a different provision of Article 15, so that the Attorney General may sue under section 24-15-10-3(b)(2) without a new 30-day notice?
What it makes you log
Logging duty
Sections 24-15-10-1 to 24-15-10-4 give the Attorney General exclusive enforcement authority, an injunction and a civil penalty up to $7,500 per violation, a 30 day notice and cure period in which the controller may give the Attorney General an express written statement that the violation is cured, and no private right of action. A written cure statement is a response to a notice, not a record the controller keeps, and the sections set no retention period and no standing right to demand a record. The Attorney General's power to request a data protection impact assessment is in IC 24-15-6-2, which this row does not cite. The cited sections state no territorial hook.
- Kind
- None
- As of
What this law does
The Indiana Attorney General has exclusive authority to enforce INCDPA, with a civil penalty of up to $7,500 per violation plus recoverable investigation expenses. Before suing, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; if the violation is cured within that period and the controller or processor provides a written attestation of the cure, the Attorney General may not initiate an action.
This cure right is mandatory, not discretionary, and carries no sunset date anywhere in Article 15, unlike Maryland's, New Jersey's, and Minnesota's time-limited or discretionary cure provisions. The chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .