Law / United States / 
Indiana
Indiana Consumer Data Protection Act, data protection impact assessments
Ind. Code §§ 24-15-6-1, 24-15-6-2
In force since .
A comprehensive regime rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
As of .
What it requires
- Conduct and document a data protection impact assessment of each processing of personal data for targeted advertising, each sale of personal data, each profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, each processing of sensitive data, and any other processing that presents a heightened risk of harm to consumers.
- Make each assessment weigh the benefits of the processing to you, the consumer, other stakeholders and the public against the risks to the consumer's rights as mitigated by safeguards, and factor in de-identified data, consumers' reasonable expectations, the context of the processing and your relationship with the consumer.
- Make an assessment available to the Attorney General when it is requested under a civil investigative demand as relevant to an investigation.
- Apply the assessment duty to processing activities created or generated after , and not to earlier ones.
These lines are LexLint's reading of the law's text, as of .
What it makes you log
Who may demand the log
Regulator
What the log must hold
Decision basis
Logging duty
A controller must conduct and document a data protection impact assessment of targeted advertising, the sale of personal data, risky profiling, the processing of sensitive data and any processing that presents a heightened risk of harm to consumers (24-15-6-1(b)), and the assessment must weigh the benefits of the processing against the risks to the consumer's rights (24-15-6-1(c)). On a civil investigative demand the Attorney General may request an assessment, the controller must make it available, and the Attorney General may evaluate it for compliance with chapter 4 (24-15-6-2(a)); assessments are confidential and exempt from public inspection (24-15-6-2(b)). The chapter sets no period for keeping an assessment. The chapter has no scope clause; the reach and the consumer definition are in 24-15-1-1 and 24-15-2-8, which this row does not cite. The breach act's enforcement chapter, IC 24-4.9-4, is already cited by the breach row and holds only the deceptive-act and penalty provisions.
- Kind
- Explicit
- As of
- Provision
- Ind. Code 24-15-6-1(b), (c) and 24-15-6-2(a)
- Trigger
- personal_data_processing
What this law does
INCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.
Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards.
The Attorney General may request, pursuant to a civil investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with the controller responsibilities in chapter 4. Assessments are confidential and exempt from public inspection and copying, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The requirements apply to processing activities created or generated after .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach or makes high-risk automated decisions.