What Is the Indiana Consumer Data Protection Act?
INCDPA applies to a person doing business in Indiana or targeting Indiana residents that meets either the 100,000-consumer branch or the 25,000-consumer-plus-more-than-50%-sale-revenue branch, subject to exemptions. Rights include access, correction, deletion, portability, and opt-outs from sale, targeted advertising, and certain profiling. Controllers generally respond within 45 days, with a possible 45-day extension, and decide appeals within 60 days. The Attorney General has exclusive enforcement authority, with a 30-day written notice-and-cure process and penalties up to $7,500 per violation; there is no private right of action.
At a glance
- Full name
- Indiana Consumer Data Protection Act
- Short code
- INCDPA
- Effective date
- January 1, 2026
- Response reference
- 45 days in this snapshot
- Cure period
- 30 days in this snapshot
- Private right of action
- No
- Enforcement
- Indiana Attorney General. Consumer Protection Division
- Penalty reference
- Up to $7,500 for each violation under Ind. Code § 24-15-10-2, plus reasonable enforcement expenses
- Statutory citation
- Ind. Code §§ 24-15-1-1–24-15-10-3.
Who INCDPA applies to
A business is covered if it meets the applicability thresholds set out in Ind. Code §§ 24-15-1-1–24-15-10-3.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Conducts business in Indiana or targets Indiana residents, AND
- Controls or processes personal data of 100,000+ Indiana consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ Indiana consumers AND derives over 50% of gross revenue from the sale of personal data
Consumer rights under INCDPA
Access, correct, delete, port, opt out of sale, targeted advertising, and certain profiling
45-day response, possible 45-day extension, and 60-day appeal decision
AG enforcement, no private right of action
Notable features (vs. CCPA)
INCDPA took effect January 1, 2026. It provides access, correction, deletion, portability, and opt-out rights for targeted advertising, personal-data sales, and profiling; controllers generally have 45 days to respond, with a possible 45-day extension, and appeals receive a 60-day decision period. The Attorney General has exclusive enforcement authority, with a statutory 30-day cure process and a civil penalty of up to $7,500 per violation. The cited article does not mandate a universal opt-out mechanism.
Enforcement and penalty reference
Enforcing agency: Indiana Attorney General. Consumer Protection Division
Penalty reference: Up to $7,500 for each violation under Ind. Code § 24-15-10-2, plus reasonable enforcement expenses
Cure period: Before initiating an action, the Attorney General must give written notice identifying the specific alleged violations. If the controller or processor cures within 30 days and provides the required express written statement that the violations are cured and will not recur, the statute limits the action that may be initiated; this is an enforcement condition, not a consumer-response deadline.
Private right of action: INCDPA has no private right of action. Enforcement is exclusive to the Indiana Attorney General. Consumer Protection Division.
Where to file a complaint: Indiana Attorney General. Consumer Protection
How to exercise your INCDPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Indiana residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Indiana Attorney General. Consumer Protection complaint route at https://www.in.gov/attorneygeneral/consumer-protection-division/file-a-complaint. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a INCDPA privacy request, $9 one-time
FAQ
How is INCDPA different from Virginia's VCDPA?+
Both laws provide access, correction, deletion, portability, and opt-out rights, but their definitions, exemptions, notice requirements, and enforcement mechanics differ. Compare the current Indiana and Virginia texts instead of treating them as interchangeable.
Official sources & citations
Compare with sibling state laws
INCDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: