Key Facts
Overview
Indiana's INCDPA closely follows the Virginia VCDPA template, with a permanent 30-day cure period and GDPR-style data protection assessments. It takes effect January 1, 2026, and features a narrower health data definition than some other states.
What This Means for Your Website
- Opt-in consent is required for sensitive data processing of Indiana visitors
- Data protection assessments are needed for targeted advertising, profiling, and data sales
- Consumer requests must be fulfilled within 45 days (extendable by 45)
- A permanent 30-day cure period applies before enforcement action
Key Requirements
The Indiana AG enforces the INCDPA with penalties up to $7,500 per violation. The law follows the VCDPA template with data minimization requirements and consumer rights including access, correction, deletion, portability, and opt-out. Data protection impact assessments apply to processing created from June 2026 onward.
How ConsentStack Handles This
ConsentStack detects Indiana visitors and applies the INCDPA opt-out model with opt-in for sensitive data when the law takes effect in January 2026.
Penalties
Up to $7,500 per violation.
Key Requirements
- Opt-in consent for sensitive data processing
- Data minimization: adequate, relevant, reasonably necessary
- Data protection assessments for targeted advertising and profiling
- Consumer rights: access, correct, delete, portability, opt-out
- 45-day response window extendable by 45 days
Notable Provisions
- Virginia VCDPA template
- Permanent 30-day cure period
- Narrower health data definition
- Data protection impact assessments from June 2026
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, subject to the same limitations that apply to the right to obtain a copy of your data.
Correct inaccuracies in personal data you previously provided to a controller, taking into account the nature of the data and the purposes of the processing; the right does not reach data the controller obtained from other sources.
Have a controller delete personal data you provided or that it obtained about you.
Obtain a copy or, at the controller's choice, a representative summary of the personal data you previously provided, in a portable and, where technically practicable, readily usable format when processing is automated; a controller need not provide it more than once in a twelve month period.
Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activity over time across nonaffiliated websites or online applications.
Opt out of the sale of your personal data, which Indiana defines as an exchange of personal data for monetary consideration by a controller to a third party.
Opt out of solely automated profiling used in decisions that provide or deny financial and lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services or access to basic necessities such as food and water.
Appeal a controller's refusal to act on your request through a process that must be conspicuously available and similar to the request process, and receive a written decision with the reasons for it.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to contact the Indiana Attorney General to submit a complaint.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services or charging different prices, but it may offer a different price, level or selection if you opted out of targeted advertising, sale or profiling, or through a bona fide loyalty or discount program.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with INCDPA
ConsentStack helps you implement Opt-out consent for Indiana, United States automatically.