Lexology May 5, 2023
Indiana has become the seventh state to enact a “comprehensive” data privacy law, joining California, Virginia, Colorado, Connecticut, Utah, and Iowa. On May 1, 2023, the governor of Indiana signed Senate Bill 5, also known as the Indiana Consumer Data Protection Act (INCDPA). Indiana’s new law is similar to the Virginia, Utah, and Iowa privacy laws in that it takes a more “business-friendly” approach by, for instance, narrowly defining the kinds of disclosures of personal data (“sales”) requiring opt-in consent and providing a mandatory right to cure.
We highlight key provisions of the INCDPA below.
Application Thresholds
The INCDPA applies to companies conducting business in Indiana or producing products or services targeted to Indiana residents that during a calendar year...