Indiana Privacy Compliance Checklist

Indiana Consumer Data Protection Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the INCDPA compliance checklist?

The INCDPA compliance checklist is a 12-step plan for meeting the Indiana Consumer Data Protection Act (INCDPA), Indiana's consumer privacy law, which took effect January 1, 2026. It is enforced by the Indiana Attorney General — Consumer Protection Division, with civil penalties up to $7,500 per violation and a 30-day cure period to fix violations before a fine. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: January 1, 2026 | Cure period: 30 days

1
Determine INCDPA applicability: confirm whether your organization processes personal data of 100,000+ Indiana residents, or 25,000+ residents while deriving 50%+ of gross revenue from data sales. Check entity-level exemptions — HIPAA-covered entities, GLBA financial institutions, nonprofits, higher education, and government entities are fully exempt at the entity level
2
Post a prominent privacy notice or data-rights link on your website — AG Rokita has identified privacy notice compliance as an early enforcement priority. The notice must disclose: categories of personal data processed, purposes of processing, categories of third-party recipients, how consumers can exercise their rights, and categories of data shared with third parties
3
Implement opt-out mechanisms for three categories: sale of personal data (monetary exchange), targeted advertising, and profiling that produces legal or similarly significant effects. Note that Indiana defines "sale" narrowly — only monetary exchanges qualify, not consideration-based data sharing
4
Obtain opt-in consent before processing any of the 8 sensitive data categories: racial/ethnic origin, religious beliefs, health diagnoses, sexual orientation, citizenship/immigration status, genetic or biometric data for identification, precise geolocation (1,750-foot radius), and children's data (under 13). Implement consent mechanisms that are specific, informed, and freely given
5
Build consumer rights request intake and fulfillment processes with a 45-day response window (extendable by 45 additional days with notice to consumer). Include a 10-business-day acknowledgment of receipt. You may provide either a full data copy or a "representative summary" for access requests — Indiana uniquely permits this summary approach
6
Establish an appeals process for denied requests: consumers must be able to appeal within a reasonable time, and the controller must respond within 60 days. Include a mechanism for the consumer to contact the Indiana Attorney General if the appeal is denied — provide the AG complaint portal link in your response
7
Implement age-appropriate protections: for known children under 13, obtain opt-in consent before any data processing. For consumers 13-17, obtain consent before processing for targeted advertising or data sale. Document your age-awareness procedures consistent with the COPPA framework
8
Review and update all data processor agreements to include INCDPA-mandated provisions: clear processing instructions, confidentiality obligations, deletion or return of data upon contract termination, audit cooperation rights, and subcontractor flow-down requirements
9
Apply data minimization principles: collect only personal data that is adequate, relevant, and reasonably necessary for the disclosed purpose. Retain data only for as long as necessary. Conduct and document purpose limitation assessments
10
Prepare for AG enforcement inquiries: maintain records of all consumer requests, responses, and opt-out signals. AG Rokita's office has indicated they will conduct independent reviews in addition to responding to consumer complaints. Establish a 30-day cure-period response protocol — designate a compliance point person who can assess and remediate alleged violations within the statutory cure window
11
Conduct a data protection assessment for processing activities that present heightened risk of harm: targeted advertising, sale of personal data, processing sensitive data, and profiling. Document the assessment and maintain it for AG inspection
12
Map INCDPA requirements against overlapping state laws (Virginia VCDPA, Kentucky KCDPA, Iowa ICDPA) since all follow the VCDPA model — identify Indiana-specific controls including the narrower correction right, representative summary option for access requests, and permanent cure period

Key Enforcement Details

Enforced By

Indiana Attorney General — Consumer Protection Division

Penalty / Violation

$7,500

Cure Period

30 days

Private Right of Action

Related Resources

Indiana Privacy Law — Full Guide
Compare Indiana with Other States
Indiana Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

INCDPA Compliance Checklist FAQ

What is the INCDPA compliance checklist?

It is a 12-step plan organizations use to meet the Indiana Consumer Data Protection Act (INCDPA), which took effect January 1, 2026. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Indiana law.

Who has to comply with the Indiana Consumer Data Protection Act?

The INCDPA generally applies to organizations that handle Indiana residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for INCDPA non-compliance?

The Indiana Attorney General — Consumer Protection Division can impose civil penalties of up to $7,500 per violation and a 30-day cure period to fix violations before a fine. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put INCDPA Into Practice on Your SiteSponsored

Termly builds and maintains an Indiana-ready privacy policy, a cookie consent banner, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests INCDPA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if Indiana Consumer Data Protection Act applies to your business.

Check Applicability

Official Resources

INCDPA Full Text — IC 24-15 (Indiana Legislature)
Senate Bill 5 — Consumer Data Protection (2023 Session)
Indiana Consumer Data Protection Bill of Rights (AG Rokita)
Indiana Attorney General — Consumer Protection Division
File a Consumer Complaint (Indiana AG)
AG Rokita Leads Data Privacy Initiatives (State of Indiana)