Indiana Consumer Data Protection Act (Indiana CDPA )
The Indiana CDPA protects the privacy and personal information rights of Indiana’s 6.8 million residents, and establishes data privacy responsibilities for companies doing business in the state or providing goods or services targeting Indiana residents.
Is Complying with Indiana CDPA Mandatory?
The Indiana CDPA applies to organizations conducting business in Indiana, and any business that offers products or services targeted to Indiana residents. The organization itself does not have to be based in the state. Indiana CDPA compliance has two primary threshold criteria for organizations (“controllers” under the law):
control or process the personal information of at least 100,000 Indiana residents during a calendar year,
or
control or process the personal information of at least 25,000 Indiana consumers during a calendar year, and derive more than 50% of their gross revenue from the sale of personal information
What are the penalties for not complying with Indiana CDPA?
A controller or processor found to be in violation of Indiana’s data privacy regulation is subject to a fine of up to US $7,500 per violation.