Indiana Privacy & Security Compliance Guide

🚨 INDIANA: NEW COMPREHENSIVE LAW ACTIVE JAN 1, 2026

CRITICAL UPDATE: Indiana Consumer Data Protection Act went live January 1, 2026. Businesses processing Indiana resident data must comply immediately.

Who Must Comply:
• Businesses processing 100,000+ Indiana consumers' data per year
• OR processing 25,000+ consumers with 50%+ revenue from data sales
• Applies regardless of physical presence in Indiana

Key ICDPA Requirements:
• Consumer Rights: Access, deletion, correction, data portability, opt-out of sales
• Privacy Notices: Clear disclosure of data collection, processing purposes
• Data Protection Assessments: Required for sensitive data processing
• Opt-Out Mechanisms: Universal opt-out signal recognition
• 30-Day Cure Period: AG provides cure opportunity for good-faith violations

Pharmaceutical Industry Alert: Eli Lilly headquarters means massive pharma data concentration. Clinical trial data, patient information, and research data require enhanced ICDPA protections.

Racing Industry Data:
• Indianapolis Motor Speedway fan databases
• NASCAR team telemetry and analytics
• Racing participant personal information
• Ticket sales and hospitality data

Enforcement Timeline: Indiana AG establishing enforcement priorities Q1 2026. Expect early enforcement actions targeting obvious violations (no privacy policy, no opt-out mechanism). Good-faith compliance efforts will receive cure period.