Indiana ICDPA Compliance: What Business Owners Need to Know

Quick Answer

As of January 1, 2026, Indiana has its own comprehensive consumer data privacy law. The Indiana Consumer Data Protection Act — commonly called the ICDPA — establishes new requirements for how businesses collect, process, store, and share the personal data of Indiana residents.

If you run a business in Indiana and handle customer data, this law is worth understanding. Even if your business does not currently meet the thresholds that trigger full compliance, the ICDPA signals a clear direction: consumer data privacy expectations are rising, and Indiana businesses should be preparing.

Here is what business owners need to know.

Who Does the ICDPA Apply To?

The ICDPA applies to businesses that conduct business in Indiana or produce products or services targeted at Indiana consumers and meet at least one of these thresholds:

• Control or process the personal data of 100,000 or more Indiana consumers in a calendar year, OR
• Control or process the personal data of at least 25,000 Indiana consumers AND derive more than 50% of gross revenue from the sale of personal data.

Certain organizations are exempt, including state and local government entities, nonprofits, institutions of higher education, entities already covered by HIPAA or the Gramm-Leach-Bliley Act, and some financial institutions.

If your business is not currently at these thresholds, you are not off the hook entirely. Indiana’s existing data breach notification law — which predates the ICDPA — still requires businesses of any size to notify affected individuals and, in many cases, the Attorney General within specific timeframes after a data breach.

What Does the ICDPA Require?

For businesses that meet the applicability thresholds, the ICDPA establishes several core obligations:

 

Privacy Notice:

You must provide consumers with a clear, accessible privacy notice that describes what personal data you collect, why you collect it, the categories of third parties with whom you share it, and how consumers can exercise their rights.

 

Consumer Rights:

Indiana consumers gain the right to confirm whether a business is processing their data, access the personal data a business holds about them, correct inaccuracies, request deletion of their data, obtain a portable copy of their data, and opt out of the sale of personal data, targeted advertising, and certain profiling.

 

Data Protection Assessments:

Businesses must conduct data protection assessments for certain higher-risk processing activities, including targeted advertising, the sale of personal data, processing of sensitive data, and profiling that could create a risk of harm.

 

Data Minimization and Purpose Limitation:

You should only collect personal data that is reasonably necessary for the purposes disclosed to the consumer. Using data for undisclosed purposes or collecting more than needed creates compliance risk.

 

Reasonable Security Practices:

The ICDPA requires businesses to implement reasonable administrative, technical, and physical data security practices. While the law does not prescribe specific technical standards, the expectation is that your security measures are appropriate for the volume and sensitivity of data you handle.

 

How Is the ICDPA Enforced?

The Indiana Attorney General has exclusive enforcement authority. There is no private right of action under the ICDPA, meaning individual consumers cannot sue businesses directly for violations.

However, the Attorney General can issue civil investigative demands and impose penalties. Importantly, the ICDPA includes a 30-day cure period: if the Attorney General identifies a violation, the business has 30 days to cure it before penalties are assessed. This cure period is set to expire on January 1, 2028, after which the Attorney General gains discretion on whether to offer a cure opportunity.

What Should Indiana Businesses Do Now?

Whether or not your business currently meets the ICDPA thresholds, there are practical steps worth taking:

• Audit your data practices. Know what personal data you collect, where it is stored, who has access, and with whom you share it.
• Review your privacy notice. Make sure it accurately reflects your current data practices. If you do not have one, create one.
• Assess your vendors. If you share consumer data with third-party processors, make sure you have data processing agreements in place.
• Develop a breach response plan. Indiana’s breach notification law requires notification within 45 days. Having a plan in place before a breach occurs makes the response faster and less chaotic.
• Talk to an attorney. Data privacy law is evolving quickly. An attorney can help you assess where your business stands and what steps are worth prioritizing.

 

The Bigger Picture

Indiana is now one of more than a dozen states with a comprehensive consumer data privacy law. The trend is clear: businesses that handle personal data are expected to be transparent, deliberate, and protective.

For many Indiana business owners, the ICDPA is also a prompt to look at data practices more broadly. Even beyond compliance, treating customer data with care builds trust — and trust is good for business.

 

Schedule a Consultation

If you have questions about whether the ICDPA applies to your business or how to prepare, the attorneys at Boren, Oliver & Coffey are here to help. We work with Indiana business owners to understand their legal obligations and build practical approaches to compliance.

Click Here to Schedule a Consultation 

Frequently Asked Questions

 

Does the ICDPA apply to small businesses?

It depends on how much consumer data you process. The thresholds are based on the number of Indiana consumers whose data you handle, not on business size or revenue. Many small businesses that collect customer data through websites, email lists, or online transactions could approach these thresholds over time.

 

What counts as “personal data” under the ICDPA?

Personal data is any information linked or reasonably linkable to an identified or identifiable individual. This includes names, email addresses, phone numbers, IP addresses, browsing behavior, purchase history, and more. It does not include de-identified data or publicly available information.

 

What happens if my business has a data breach?

Indiana’s data breach notification law requires you to notify affected individuals within 45 days and, in many cases, notify the Attorney General. Having a written response plan in place before a breach occurs is strongly recommended.