What Is the Indiana Consumer Data Protection Act?
INCDPA applies to controllers processing data of 100,000+ Indiana consumers or 25,000+ while selling data. Rights include delete, access, correct, port, and opt-out of sale, targeted advertising, and profiling. Enforcement is exclusive to the AG with a 30-day cure period and civil penalties up to $7,500 per violation.
At a glance
- Full name
- Indiana Consumer Data Protection Act
- Short code
- INCDPA
- Effective date
- January 1, 2026
- Response deadline
- 45 days
- Cure period
- 30 days
- Private right of action
- No
- Enforcement
- Indiana Attorney General — Consumer Protection Division
- Maximum penalty
- Up to $7,500 per violation under the Indiana Deceptive Consumer Sales Act
- Statutory citation
- Ind. Code § 24-15
Who INCDPA applies to
A business is covered if it meets the applicability thresholds set out in Ind. Code § 24-15. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Conducts business in Indiana or targets Indiana residents, AND
- Controls or processes personal data of 100,000+ Indiana consumers in a calendar year, OR
- Controls or processes personal data of 25,000+ Indiana consumers AND derives over 50% of gross revenue from the sale of personal data
Consumer rights under INCDPA
Delete, access, correct, port, opt-out
AG enforcement, no private right of action
Notable features (vs. CCPA)
INCDPA is closely modeled on Virginia's VCDPA and Utah's UCPA — a business-friendly framework with a permanent 30-day cure period, AG-exclusive enforcement, and no universal opt-out mechanism mandate. Indiana gave businesses one of the longest lead times in the country (the law was signed in May 2023 but does not take effect until January 2026) to build compliance programs.
Enforcement & penalties
Enforcing agency: Indiana Attorney General — Consumer Protection Division
Maximum penalty: Up to $7,500 per violation under the Indiana Deceptive Consumer Sales Act
Cure period: INCDPA carries a permanent 30-day cure period with no sunset — among the most business-friendly in the US.
Private right of action: INCDPA has no private right of action. Enforcement is exclusive to the Indiana Attorney General — Consumer Protection Division.
Where to file a complaint: Indiana Attorney General — Consumer Protection
How to exercise your INCDPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies INCDPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Indiana resident (e.g., ZIP code, email associated with your record).
- 3
Under INCDPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Indiana Attorney General — Consumer Protection at https://www.in.gov/attorneygeneral/consumer-protection-division/file-a-complaint.
Use your rights
INCDPA-compliant deletion emails, $5 one-time
OfflistMe drafts INCDPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
How is INCDPA different from Virginia's VCDPA?+
Substantively similar. Both have no private right of action, similar scope thresholds, and VA-style deletion rights. Differences are narrow: INCDPA has a longer cure period (30 days vs 30 days per VA), and enforcement mechanics are slightly different, but consumers experience nearly identical rights.
Official sources & citations
Compare with sibling state laws
INCDPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: