Indiana Adopts Its First Consumer Data Privacy Statute

On May 1, 2023, Gov. Holcomb signed into law Indiana's first consumer data privacy statute. Indiana now joins California, Colorado, Connecticut, Iowa, Virginia and Utah in adopting consumer data privacy protections. Fortunately, Senate Enrolled Act 5 will not take effect until January 1, 2026, so Indiana businesses have some time to make the necessary adjustments.

Who is impacted by this statute?

The statute broadly applies to persons that conduct business in Indiana or produce products or services targeted to residents of Indiana, and:

• Control or process personal data of at least 100,000 Indiana consumers; or
• Control or process personal data of at least 25,000 Indiana consumers and derive more than 50 percent of their gross revenue from the sale of personal data. Like similar statutes, it does not apply to the state or state agencies, institutions already covered by the Gramm-Leach-Bliley Act or HIPAA, higher education, public utilities or nonprofits.