Governance, risk & compliance

Indiana Consumer Data Protection Act (ICDPA) IC 24-15; in force 1 Jan 2026 (P.L.94-2023)

The Indiana Consumer Data Protection Act is Indiana Code Article 24-15 (P.

L. 94-2023, SEA 5), in force from 1 January 2026.

It applies to businesses in Indiana or targeting Indiana residents that handle the personal data of 100,000 or more consumers a year, or 25,000 or more while earning over half of revenue from selling personal data. Nonprofits, higher education, financial institutions and HIPAA entities are exempt.

Consumers can confirm and access, correct data they provided, delete, take a copy or representative summary (once a year), and opt out of targeted advertising, sale and profiling. Responses are due in 45 days (extendable by 45) and appeals in 60 days.

Sensitive data needs consent, and known child data must follow COPPA. Controllers must give a privacy notice, disclose sales and targeted advertising, offer secure request methods, and keep reasonable security.

Processors need a binding contract. Data protection assessments apply to processing created or generated after 31 December 2025.

The Attorney General enforces alone: a 30-day notice and cure with no sunset, then up to $7,500 per violation. There is no private right of action and no universal opt-out requirement in the text read.

Read from the 2026 Indiana Code PDF and the Attorney General’s consumer bill of rights. P.

L. 236-2025 amended IC 24-15-1-1; its content was not read.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Indiana Consumer Data Protection Act (ICDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Indiana Consumer Data Protection Act (ICDPA) compliance

Most of Indiana Consumer Data Protection Act (ICDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Indiana Consumer Data Protection Act (ICDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Indiana Consumer Data Protection Act (ICDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Indiana Consumer Data Protection Act (ICDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.