Your Indiana consumer data rights
In effect
Indiana's consumer data protection law gives Indiana residents rights over the personal data that covered businesses collect about them. It has been in effect since January 1, 2026.
- Who or what it protects
- Indiana residents, in their dealings with businesses in Indiana or targeting its residents that process the personal data of at least 100,000 Indiana consumers a year, or of at least 25,000 while earning more than half of their gross revenue from selling personal data. Government bodies, financial institutions covered by federal banking privacy law and organizations covered by HIPAA are among those exempt.
- What you can do
- You can confirm whether a business processes your personal data and see it. You can correct inaccuracies in data you gave the business, and delete data you provided or that it obtained about you. You can get a copy, or a summary, of the data you gave the business, in a form you can take elsewhere, once a year; the business chooses which. You can opt out of targeted advertising, the sale of your data, and profiling used for decisions with legal or similarly significant effects. Use the method in the company's privacy notice. It must respond within 45 days, which it can extend once by 45 days, and tell you how to appeal if it declines. You can file a Consumer Data Privacy Act complaint with the Indiana Attorney General.
- Limits and eligibility
- Only the Indiana Attorney General enforces the law, and it gives you no right to sue. A business gets 30 days to fix a violation after notice. The right to correct covers only data you gave the business.
- Who oversees it
- Indiana Attorney General
- The law
- Indiana Consumer Data Protection Act
Checked against the official sources on October 6, 2026. Links last checked November 1, 2026.