Indiana prepares for 2026 data privacy law with new Consumer Bill of Rights

Indiana’s new Consumer Data Protection Act (INCDPA) takes effect January 1, 2026, and the Attorney General has released a Consumer Data Privacy Bill of Rights to help Hoosiers understand and use their new data rights.​

What the new law does

• The INCDPA is a comprehensive state privacy law that gives Indiana residents more control over how companies collect, use, and share their personal data.​

• It applies to for‑profit businesses that do business in Indiana or target Indiana residents and meet data volume or revenue thresholds, such as handling data on at least 100,000 consumers annually or 25,000 consumers with more than half of revenue from data sales.​

Consumer Bill of Rights

• The Consumer Data Privacy Bill of Rights explains in plain language how the INCDPA works and outlines key rights like accessing, correcting, deleting, and porting personal data, and opting out of targeted ads, data sales, and certain profiling.​

• It is designed both to educate consumers and to serve as a practical roadmap for businesses preparing compliance programs before the 2026 effective date.​

Key rights for Hoosiers

• Hoosiers gain rights to: know if a company is processing their data, access that data, request corrections, request deletion, obtain a portable copy, and opt out of targeted advertising, sale of data, and automated profiling with significant effects.​

• Companies must provide clear privacy notices and offer simple methods to exercise these rights, respond generally within 45 days (with limited extensions), and provide an appeals process if requests are denied.​

Obligations for businesses

• Covered businesses must implement reasonable security measures, limit data collection to what is necessary for stated purposes, and obtain consent before processing sensitive data.​

• They also need to update privacy notices, map data, set up opt‑out and consent mechanisms, revise contracts with processors, and conduct data protection assessments where required, using the Bill of Rights as a guide to get ready for 2026 enforcement.​

Indiana in the broader privacy trend

• Indiana became the seventh state with a comprehensive data privacy law when the INCDPA was signed in May 2023, following a model similar to Virginia’s law.​

• With enforcement starting in 2026, Indiana joins a growing group of states creating baseline privacy protections while federal lawmakers continue to debate nationwide standards.​