Indiana Releases Consumer Data Privacy Bill Of Rights

Ahead of implementation of Indiana's comprehensive data privacy law, Indiana's Attorney General has released a Consumer Data Privacy Bill of Rights describing how the Indiana Consumer Data Protection Act ("ICDPA"), enacted in 2023, will operate when it takes effect on January 1, 2026. Although styled for consumers, the Bill of Rights functions as a practical compliance roadmap for businesses subject to the law. It reiterates the ICDPA's scope and thresholds, articulates the core consumer rights, and underscores concrete controller obligations around transparency, data minimization, purpose limitation, sensitive data handling, and response timelines.

The ICDPA applies to for-profit entities that conduct business in Indiana or target Indiana residents and either control or process personal data of at least 100,000 Indiana residents in a calendar year, or control or process personal data of at least 25,000 Indiana residents and derive more than 50% of gross