The Indiana Legislature is poised to pass Senate Bill 5, a comprehensive privacy statute (the “Act”), and send it on to the Governor. Once signed, the Act will become operative on January 1, 2026, and make Indiana the seventh state, after California, Colorado, Connecticut, Iowa, Utah, and Virginia to enact a comprehensive consumer privacy statute.

Key Elements

Similar to the Colorado Privacy Act (CPA) and the Virginia Consumer Data Privacy Act (VCDPA), the Act was modeled in part on the CCPA, CPRA, and the EU General Data Protection Regulation (GDPR). But there are some variations. Key elements of the UCPA include:

When does the Act apply? The Act applies to persons that conduct business in Indiana or produce products or services that are targeted to residents of the state and that, during a calendar year:

  • Control or process personal data of at least 100,000 consumers who are residents of the state, or
  • Control or process personal data of at least 25,000 consumers who are residents of the state and derive more than 50% of gross revenue from the sale of personal data.

Are there exemptions? Among the persons not subject to the Act include Indiana and state agencies, third-party contractors of the state and such agencies acting on their behalf (but only with respect to such contracts), financial institutions, HIPAA-covered entities and business associates, not-for-profit organizations, institutions of higher education, and public utilities.

Who is protected under the Act? The Act protects the personal information of a “consumer,” defined as an individual who:

  • Is a resident of the state, and
  • Is acting only for personal, family, or household purposes.

Like the recently passed Iowa statute, Indiana excludes individuals acting in a commercial or employment context from its definition of consumer.

What “personal data” is protected under the Act? Under the Act, personal data is defined broadly as information that is linked or reasonably linkable to an individual. The definition excludes de-identified data, aggregate data, or publicly available information.

What rights do consumers have under the Act? The Act provides consumers with the following rights:

  • The right to request confirmation of whether a business is processing their personal data and related information.
  • The right to access their personal data upon request.
  • The right to correct information a company possesses
  • The right to delete personal information obtained by businesses
  • The right to opt out of the processing of personal data for purposes of targeted advertising, sale of personal data, or certain profiling activities.

The rules surrounding the administration of these rights pull from similar language in the other state privacy laws – a 45-day period to respond, a verification requirement, and a right to appeal a controller’s adverse decision concerning a consumer right request.

What obligations do covered persons have?

The Act lays out a list of obligations for controllers which generally track the laws in the other states. Without limitation, controllers must:

  • limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed,
  • establish, implement, and maintain reasonable administrative, technical, and physical security practices to protect the confidentiality, integrity, and accessibility of personal data,
  • not discriminate against a consumer for exercising rights under the Act,
  • not process sensitive data without the consumer’s consent,
  • provide consumer with a privacy notice that explained among other things the categories of personal data the controller processes and shares with third parties, and
  • provide consumers the opportunity to opt out of the sale of personal data and explain the means to exercise these and other rights under the Act.

For processing activities created or generated after December 31, 2025, controllers need to conduct and document impact assessments for certain processing activities, such as the sale of personal data and the processing of sensitive data. In short, these assessments must weigh the benefits of the processing and the risks to the consumer, considering risk mitigation efforts by the controller.

With respect to processors, the Act requires they adhere to the instructions of controllers, such as assisting the controller with responding to consumer requests. Contracts between controllers and processors must include certain provisions, such as instructions for processing personal data, the nature and duration of the processing. Other required provisions include (i) a requirement for processors to make available all information in the processor’s possession to demonstrate the processor’s compliance with the Act, (ii) cooperating with reasonable assessments of compliance by the controller (or arrange for a qualified and independent assessor), and (iii) obligating the processor to push the Act’s required provisions down to the processor’s subcontractors 

How is the law enforced, any private right of action? Unlike the CCPA, Indiana’s statute does not include a private right of action for consumers. In fact, the Act states that “[n]othing in [the Act] shall be construed as providing the basis for a private right of action for violations of this article or any other law.” Instead, the state attorney general will have exclusive enforcement authority. Businesses that are found to have violated the law may face fines of up to $7,500 per violation.

For additional information on Indiana’s new privacy statute and other data privacy laws and regulations, please reach out to a member of our Privacy, Data, and Cybersecurity practice group.

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Joseph J. Lazzarotti Joseph J. Lazzarotti

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the…

Joseph J. Lazzarotti is a principal in the Tampa, Florida, office of Jackson Lewis P.C. He founded and currently co-leads the firm’s Privacy, Data and Cybersecurity practice group, edits the firm’s Privacy Blog, and is a Certified Information Privacy Professional (CIPP) with the International Association of Privacy Professionals. Trained as an employee benefits lawyer, focused on compliance, Joe also is a member of the firm’s Employee Benefits practice group.

In short, his practice focuses on the matrix of laws governing the privacy, security, and management of data, as well as the impact and regulation of social media. He also counsels companies on compliance, fiduciary, taxation, and administrative matters with respect to employee benefit plans.

Photo of Dorothy Parson McDermott Dorothy Parson McDermott

Dorothy “Dottie” McDermott is a principal in the Indianapolis, Indiana, office of Jackson Lewis P.C. She oversees defense of demand letters, charges, litigations and advice and counsel across Jackson Lewis’s nationwide footprint of offices, making portfolio management easier for in-house counsel and leadership…

Dorothy “Dottie” McDermott is a principal in the Indianapolis, Indiana, office of Jackson Lewis P.C. She oversees defense of demand letters, charges, litigations and advice and counsel across Jackson Lewis’s nationwide footprint of offices, making portfolio management easier for in-house counsel and leadership across jurisdictions. Clients ranging from Fortune 500 companies to small family-owned businesses, in-house counsel, and members of human resources and management teams appreciate Dottie’s sage and practical input as she aligns proposed defense and resolution strategies with business goals and objectives.

Dottie has more than 20 years of experience defending employers of all sizes, human resources professionals, and management teams in the defense of civil rights and employment-related claims and complex ERISA litigation, single plaintiff ERISA cases. This includes matters before federal and state courts and administrative entities involving claims of discrimination, harassment, wrongful termination and/or retaliation under the ADA, ADEA, COBRA, Equal Pay Act, FMLA, GINA, Title VII, Section 1981, and USERRA. Additionally, she participates in internal FLSA audits on behalf of employers, and the defense of FLSA and ERISA 401(k) collective and class action litigation and defense of other wage hour claims.

Dottie also advises employers and management on human resource issues, background checks and the FCRA, reductions in force and WARN compliance, employee handbooks, policies, severance agreements, EEO training, drug testing issues and workplace violence prevention restraining orders. She also leads internal corporate investigations regarding claims of sexual harassment and discrimination.