May 2023

1. Governing Texts

1.1. Key acts, regulations, directives, bills

The Consumer Data Protection Act (CDPA) added to Indiana Code (Ind. Code) §24-15 was signed by the Governor of Indiana on May 1, 2023, and enters into effect on January 1, 2026. 

1.2. Guidelines

No further information.

1.3. Case law

No further information.

2. Scope of Application

2.1. Personal scope

The CDPA is applicable to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana, and that during a calendar year (Indiana Code (Ind. Code) §24-15-1-1(a)):

• controls or processes personal data of at least 100,000 consumers who are Indiana residents; or
• controls or processes personal data of at least 25,000 consumers who are Indiana residents and derives more than 50% of gross revenue from the sale of personal data.

However, the CDPA clarifies that any state agency, or a body, authority, board, bureau, commission, district, or political subdivision of the state, as well as third parties acting on their behalf, financial institutions, affiliates of financial institutions, or data subject to the Gramm-Leach-Bliley Act of 1999 (GLBA) and persons subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), are not subject to the CDPA (Ind. Code §24-15-1-1(b)).

Additionally, non-profit organizations, institutions of higher education, public utilities, and service companies affiliated with a public utility are outside the CDPA's scope (Ind. Code §24-15-1(b)).

2.2. Territorial scope

The CDPA applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana (Ind. Code §24-15-1-1(a)).

2.3. Material scope

Certain types of information are exempt under the CDPA, including (Ind. Code §24-15-1-2):

• protected health information under HIPAA;
• health records that are de-identified in accordance with the requirements for de-identification under HIPAA;
• the collection, maintenance, disclosure, sale, communication, or use of any personal information relating to consumers' credit information or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, or by a user of a consumer report, only to the extent that such activity is regulated by, and authorized under, the Fair Credit Reporting Act of 1970 (FCRA) (15 U.S.C. 1681 et seq.); and/or
• data processed or maintained:
  • in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role;
  • as the emergency contact information of an individual used for emergency contact purposes; and/or
  • that is necessary to retain to administer benefits for another individual relating to the individual under point one and used for the purposes of administering the same. 

Moreover, the CDPA does not apply to personal data in the context of purely personal or household activity (Ind. Code §24-15-8-5(2)).

3. Data Protection Authority | Regulatory Authority 

3.1. Main regulator for data protection

The Indiana Attorney General (AG) is the regulator within Indiana.

3.2. Main powers, duties and responsibilities

In accordance with Ind. Code §24-15-9-1, the AG will have exclusive authority to enforce the CDPA and may, whenever they have reasonable cause to believe that any person has engaged in, or is engaging in, or is about to engage in any violation of the CDPA, issue a civil investigative demand to investigate a suspected violation.

The AG may not later than December 31, 2025, establish on the AG's website a list of resources for controllers, including sample privacy notices and disclosures, to assist controllers in compliance with the CDPA. 

4. Key Definitions

Data controller: is defined as a person that, alone or jointly with others, determines the purpose and means of processing personal data (Ind. Code §24-15-2-9).

Data processor: is defined as a person that processes personal data on behalf of a controller (Ind. Code §24-15-2-22).

Personal data: is defined as information linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data, aggregate data, or publicly available information (Ind. Code §24-15-2-19).

Sensitive data: is defined as a category of personal data which includes (Ind. Code §24-15-2-28):

• racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a healthcare provider, sexual orientation, citizenship, or immigration status;
• genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual;
• personal data collected from a known child; and
• precise geolocation data.

Health data: The CDPA does not provide a definition for 'health data.'

Biometric data: is defined as data that is generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, images of the retina or iris, or other unique biological patterns or characteristics, and is used to identify a specific individual. Biometric data does not include (Ind. Code §24-15-2-4):

• a physical or digital photograph, or data generated from a physical or digital photograph;
• a video or audio recording, or data generated from a video or audio recording; or
• information collected, used, or stored for health care treatment, payment, or operations under HIPAA.

Pseudonymization: The CDPA defines 'pseudonymous data' as personal data that cannot be attributed to a specific individual because additional information that would allow the data to be attributed to a specific individual is (Ind. Code §24-15-2-25):

• kept separately; and
• subject to appropriate technical and organizational measures;

to ensure that the personal data is not attributed to an identified or identifiable individual.

Data subject: The CDPA does not provide a definition for 'data subject' however 'consumer' is defined as an individual who is a resident of Indiana acting only for a personal, family, or household context, excluding an individual acting in a commercial or employment context (Ind. Code §24-15-2-8).

5. Legal Bases

The CDPA also notes that personal data processed by a controller for a purpose authorized under Chapter 8 of the CDPA may be processed to the extent that such processing is (Ind. Code §24-15-5-7(a) and (b)):

• reasonably necessary and proportionate to the purposes listed;
• adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section;
• personal data collected, used, or retained under §2 of Chapter 8, where applicable, takes into account the nature and purpose or purposes of such collection, use, or retention; and
• subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data.

5.1. Consent

The CDPA outlines that subject to the provisions of the CDPA, a controller must not process personal data for purposes that are neither reasonably necessary for, nor compatible with, the disclosed purposes for which the personal data is processed unless the controller obtains the consumer's consent (Ind. Code §24-15-4-1(2)).

In this regard, 'consent' is defined as a clear affirmative act that signifies a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer, which includes a written statement, including one written by electronic means, or any other unambiguous, affirmative action (Ind. Code §24-15-2-7).

5.2. Contract with the data subject

The CDPA provides that nothing provided within may restrict a controller or processor's ability to provide products or services specifically requested by a consumer, perform a contract to which the consumer, or a parent of a child, is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent before entering into a contract (Ind. Code §24-15-8-1(a)(5)).

5.3. Legal obligations

The CDPA also provides that nothing provided within may restrict the ability of controllers or processors to:

• comply with federal, state, or local laws, rules, or regulations (Ind. Code §24-15-8-1(a)(1));
• comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities (Ind. Code §24-15-8-1(a)(2));
• cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations (Ind. Code §24-15-8-1(a)(3)); or
• investigate, establish, exercise, prepare, or defend legal claims (Ind. Code §24-15-8-1(a)(4)).

5.4. Interests of the data subject

The CDPA also provides that nothing within may restrict the ability of controllers or processors to take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person and where the processing cannot be manifestly based on another legal basis (Ind. Code §24-15-8-1(a)(6)). 

5.5. Public interest

The CDPA also provides that nothing within may restrict the ability of controllers or processors to engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, or similar independent oversight entities that determine the following (Ind. Code §24-15-8-1(a)(8)):

• if the deletion of the information is likely to provide substantial benefits that do not exclusively accrue to the controller;
• the expected benefits of the research outweigh the privacy risks; or
• if the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with re-identification.

5.6. Legitimate interests of the data controller

The CDPA does not explicitly address the legitimate interest of the controller.

However, the CDPA provides that nothing within may restrict the ability of controllers or processors to (Ind. Code §24-15-8-1(a)(7) and (9)):

• prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, investigate, report, or prosecute those responsible for any such action, and preserve the integrity or security of systems; and
• assist another controller, processor, or third party with any obligation described in §1 Chapter 8 of the CDPA.

Additionally, the CDPA provides that the obligations imposed on a controller or processor under its provisions will not restrict the controller's or processor's ability to collect, use, or retain data to (Ind. Code §24-15-8-2):

• conduct internal research to develop, improve, or repair products, services, or technology;
• effectuate a product recall;
• identify and repair technical errors that impair existing or intended functionality; and
• performing internal operations that are reasonably aligned with the expectations of the consumer, reasonably anticipated based on the consumer's existing relationship with the controller, or are otherwise compatible with processing data in furtherance of the provision of a product or service specifically requested by a consumer, or parent or guardian of a child, or the performance of a contract to which any of the same is a party.

5.7. Legal bases in other instances

The obligations imposed on controllers or processors under the CDPA will not apply where compliance by the controller or processor would violate an evidentiary privilege under the laws of the state. However, nothing with the CDPA should be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of the state as part of a privileged communication (Ind. Code §24-15-5-8(3)).

6. Principles

The CDPA specifies that controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer (Ind. Code §24-15-4-1(1)). Additionally, and as mentioned above in the section on consent as a legal basis, except as otherwise provided in the CDPA, controllers must not process personal data for purposes that are neither reasonably necessary for, nor compatible with, the disclosed purposes for which the personal data is processed unless the consumer's consent is obtained (Ind. Code §24-15-4-1(2)).

Furthermore, controllers must adopt and implement reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and availability of personal data. On this point, the CDPA stipulates that such practices should be appropriate to the volume and nature of the personal data at issue (Ind. Code §24-15-4-1(3)).

7. Controller and Processor Obligations

De-identified and pseudonymous data

In particular, the CDPA specifies that a controller processing de-identified or pseudonymous data must (Ind. Code §24-15-7-1(a)):

• take reasonable measures to ensure the data cannot be associated with an individual;
• publicly commit to maintaining and using de-identified data without attempting to re-identify the data; and
• contractually obligate recipients of the de-identified data to comply with all provisions of the CDPA.

However, the CDPA clarifies that Chapter 7 will not be construed to require a controller or processor to (Ind. Code §24-15-7-1(b)):

• re-identify de-identified data or pseudonymous data;
• maintain data in the identifiable form; or
• collect, obtain, retain, or access any data or technology in order to be capable of associating an authenticated consumer request with personal data.

7.1. Data processing notification

Not applicable.

7.2. Data transfers

The CDPA does not specifically address data transfers but defines the 'sale of personal data' as the exchange of personal data for monetary consideration by the controller to a third party, noting that this does not include (Ind. Code §24-15-2-27):

• the disclosure of personal data to a processor that processes the personal data on behalf of the controller;
• the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer or a parent of a child;
• the disclosure or transfer of personal data to an affiliate of the controller;
• the disclosure of information that the consumer intentionally made available to the general public via a channel of mass media and did not restrict to a specific audience; or
• the disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

Furthermore, the CDPA stipulates that a controller or processor that discloses personal data to a processor or third-party controller in accordance with the CDPA shall not be deemed to have violated said law if the processor or third-party controller that receives and processes such personal data violates said law provided, at the time the disclosing controller or processor disclosed such personal data, the disclosing controller or processor did not have actual knowledge that the receiving processor or third-party controller would violate said sections data. In addition, a third-party controller or processor receiving personal data from a controller or processor in compliance with CDPA is likewise not in violation of said law for the transgressions of the controller or processor from which such third-party controller or processor receives such personal data.

7.3. Data processing records

Though the CDPA does not address data processing records. 

7.4. Data protection impact assessment

The CDPA requires controllers to conduct and document DPIAs for the following processing activities involving personal data (Ind. Code §24-15-6-1(b)):

• the processing of personal data for targeted advertising;
• the sale of personal data;
• the processing of personal data for purposes of profiling if such profiling presents a reasonably foreseeable risk of:
  • unfair or deceptive treatment of, or unlawful disparate impact on, consumers;
  • financial, physical, or reputational injury to consumers;
  • a physical or other intrusions upon the solitude or seclusion, or the private affairs or concerns, of consumers, if such intrusion would be offensive to a reasonable person; or
  • other substantial injuries to consumers;
• the processing of sensitive data; and
• any processing activities involving personal data that present a heightened risk of harm to consumers.

Importantly, the CDPA specifies that this requirement is applicable to processing activities created or generated after December 31, 2025, and does not apply retrospectively to any processing activity commenced before January 1, 2026 (Ind. Code §24-15-6-1(a)).

Method

A single DPIA may address a comparable set of processing operations that include similar activities (Ind. Code §24-15-6-1(d)). With regard to the manner in which DPIAs must be conducted, the CDPA outlines that DPIAs must identify and weigh the direct and indirect benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks. In this regard, the use of de-identified data, the reasonable expectations of consumers, and the context of the processing and the relationship between the controller and the consumer shall be factored into such an assessment (Ind. Code §24-15-6-1(c)).

A DPIA conducted by a controller for the purpose of compliance with other laws or regulations may be used to comply with this section if the assessment has a reasonably comparable scope and effect to an assessment conducted under the CDPA (Ind. Code §24-15-6-1(e)).

AG powers

The AG may request a controller disclose a DPIA that is relevant to an investigation it is conducting. Upon receipt of such a request, the controller must make the DPIA available to the AG (Ind. Code §24-15-6-2(a)). The AG may also evaluate the DPIA for a controller's compliance with the responsibilities set forth in the CDPA. Nevertheless, the CDPA confirms that DPIAs are confidential and exempt from public inspection and copying (Ind. Code §24-15-6-2(a)).

7.5. Data protection officer appointment

The CDPA does not address the appointment of data protection officers.

7.6. Data breach notification

The CDPA does not provide breach notification requirements. However, there are data breach requirements outlined under §24-4.9-1 et seq. of the Ind. Code.  

For further information, see Indiana – Data Breach.

7.7. Data retention

The CDPA does not expressly address data retention requirements.

7.8. Children's data

The CDPA classifies personal data collection from a known child as 'sensitive data' and further notes that in the case of a known child, controllers must process sensitive data in accordance with COPPA (Ind. Code §24-15-2-28 and §24-15-4-1(5)).

Additionally, the CDPA provides that a known child's parent or legal guardian may invoke consumer rights on behalf of the known child regarding processing personal data belonging to the child (Ind. Code §24-15-3-1(a)).

7.9. Special categories of personal data

With regard to sensitive data, controllers must not process sensitive data concerning a consumer without obtaining the consumer's consent (Ind. Code §24-15-4-1(5)).

7.10. Controller and processor contracts

The CDPA provides that controller/processor relationships must be governed by a binding contract with respect to the processing activities conducted by the processor on behalf of the controller (Ind. Code §24-15-5-2(a)). In this regard, the CDPA specifies that such a contract must set forth the instructions for processing personal data, the nature and purpose of processing, the duration of the processing, the type of data subject to processing, and the rights and duties of both parties. Controller processor contracts under the CDPA must (Ind. Code §24-15-5-2(a)):

• ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
• at the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services unless retention of the personal data is required by law;
• upon the reasonable request of the controller, make available to the controller all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations in the CDPA;
• allow, and cooperate with, reasonable assessments by the controller or their designated assessor - alternatively, the processor may arrange for a qualified and independent assessor to conduct the assessment of its policies and technical and organizational measures, which must be reported to the controller upon request; and
• engage any subcontractor or agent pursuant to a written contract that requires the subcontractor to meet the duties of the processor with respect to personal data.

Additionally, the CDPA notes that processors must adhere to the instructions of controllers and assist the same in meeting its obligations under the CDPA, which includes the following (Ind. Code §24-15-5-1):

• assisting the controller in meeting its obligation to respond to consumer rights requests by appropriate technical and organizational measures, insofar as this is reasonably practicable, and taking into account the nature of processing and the information available to the processor; and
• taking into account the nature of processing and the information available to the processor, assisting the controller in meeting its obligations in relation to:
  • the security of processing personal data; and
  • the notification of a breach of security of the processor's system; and
• providing necessary information to enable the controller to conduct and document a DPIA.

In determining whether a person is acting as a controller or processor with respect to specific processing of data, the CDPA explains that it is a fact-based determination that depends upon the context in which personal data is to be processed. To this end, a processor that continues to adhere to a controller's instructions with respect to the specific processing of personal data remains a processor (Ind. Code §24-15-5-3).

Importantly, the CDPA clarifies that nothing will be construed to relieve a controller or a processor from the liabilities-imposed controller or processor by virtue of its role in the processing relationship (Ind. Code §24-15-5-2(b)).

Furthermore, with regard to the processing of de-identified or pseudonymous data, a controller that discloses any such data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data is subject and must take appropriate steps to address any breaches of those contractual commitments (Ind. Code §24-15-7-3).

8. Data Subject Rights

The CDPA establishes consumer rights that may be invoked at any time by submitting a request to the controller. These rights can also be invoked by a known child's parent or legal guardian on behalf of the known child regarding the processing of data belonging to the child. Subsequently, a controller must comply with an authenticated consumer request to exercise any such rights. Additionally, the CDPA provides that a controller must not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers, noting that a controller shall not discriminate against a consumer for exercising any consumer rights, including by denying goods or services to the consumer, charging different prices or rates for goods and services, or providing a different level or quality of goods or services to the consumer (Ind. Code §24-15-4-4).

In line with the above, the CDPA establishes provisions for complying with consumer right requests, providing that controllers must respond to consumers without undue delay, and in any case no later than 45 days after receipt of a request. The timeframe for a response may be extended once by an additional 45 days when reasonably necessary, considering the complexity and number of consumer requests. However, in such cases, the consumer must be informed of such an extension within the original 45-day timeframe, together with the reason for the extension. Equally, the CDPA stipulates that controllers must inform data subjects without undue delay when declining to take action within the same timeframe, along with the reason for declining to take action and instructions on how to appeal the decision.

Furthermore, a controller or processor is not required to comply with an authenticated consumer rights request where the conditions below are met:

• the controller is not reasonably capable of associating the request with personal data, or it would be unreasonably burdensome for the controller to associate the request with personal data;
• the controller does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and
• the controller does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor except as otherwise permitted by the CDPA.

Importantly, the CDPA stipulates that the controller is responsible for establishing a process for a consumer to appeal refusals within a reasonable period of time after the consumer receives such a decision from the controller (Ind. Code §24-15-4-5).

The CDPA highlights that Chapter 7 of the CDPA does not require a controller or processor to comply with a request from a consumer in certain circumstances, stipulating that consumer rights and controller responsibilities do not apply to pseudonymous data in any case in which the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information (Ind. Code §24-15-7-2).

Additionally, a controller or processor is not required to comply with an authenticated consumer rights request where the conditions below are met (Ind. Code §24-15-3-1(a)).:

• the controller is not reasonably capable of associating the request with personal data, or it would be unreasonably burdensome for the controller to associate the request with personal data;
• the controller does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and
• the controller does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor except as otherwise permitted by the CDPA.

8.1. Right to be informed

The CDPA outlines that controllers must provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes (Ind. Code §24-15-4-3):

• the categories of personal data processed by the controller;
• the purpose for processing personal data;
• how consumers may exercise their consumer rights under the CDPA, including how a consumer may appeal a controller's decision with regard to the consumer's request;
• the categories of personal data that the controller shares with third parties, if any; and
• the categories of third parties, if any, with whom the controller shares personal data.

Specifically, on consumer rights, the CDPA specifies that controllers must establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their rights. Such means must take into account (Ind. Code §24-15-4-5):

• the ways in which consumers normally interact with the controller;
• the need for the secure and reliable communication of such requests; and
• the ability of the controller to authenticate the identity of the consumer making the request.

8.2. Right to access

The CDPA provides consumers with the right to access their personal data (Ind. Code §24-15-3-1(b)).

8.3. Right to rectification

The CDPA provides consumers with the right to correct inaccuracies in their personal data (Ind. Code §24-15-3-1(b)(2)).

In this regard, the CDPA highlights that upon receiving such a request from a consumer, a controller shall correct inaccurate data as requested by the consumer, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data (Ind. Code §24-15-3-1(b)(2)).

8.4. Right to erasure

The CDPA provides consumers with the right to delete personal data provided by or obtained about the consumer (Ind. Code §24-15-3-1(b)(3)).

Furthermore, in relation to information obtained from a source other than the consumer, the CDPA specifies that a controller is considered to comply with a deletion request if it (Ind. Code §24-15-3-1(c)(5)):

• retains:
  • a record of the consumer's request for deletion; and
  • the minimum data necessary to ensure that the consumer's personal data remains deleted from the controller's records; and
• does not use the data retained above for any other purpose.

8.5. Right to object/opt-out

The CDPA provides consumers with the right to opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer (Ind. Code §24-15-3-1(b)(5)).

8.6. Right to data portability

The CDPA provides for the right to obtain a copy or summary of a consumer's personal data that they previously provided to the controller, in a portable, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means (Ind. Code §24-15-3-1(b)(4)).

8.7. Right not to be subject to automated decision-making

The CDPA does not expressly provide for the right not to be subject to automated decision-making. However, it defines 'profiling' as any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health or health records, personal preferences, interests, reliability, behavior, location, or movements (Ind. Code §24-15-2-23).

As such, as far as automated decision-making falls within the definition of 'profiling', consumers have the right to opt out of such a processing activity, as mentioned in the section on the right to opt-out above.  

8.8. Other rights

No further information.

9. Penalties

The CDPA outlines that the AG has exclusive authority to enforce the CDPA's provisions and has the authority to issue a civil investigation where there is a reasonable cause to believe any person is engaging in or is about to engage in, any violation of the CDPA. Accordingly, the AG may bring an action in the name of the state and seek an injunction to restrain any violations of the CDPA and/or a civil penalty that does not exceed $7,500 for each violation.

Importantly, the AG must provide controllers or processors 30 days written notice identifying the provisions of the CDPA alleged to, or that have been violated, before initiating any action. If, within 30 days, the controller or processor rectifies the aforementioned violation and provides the AG with an express written statement that the alleged violations have been resolved and that no further violations shall occur, no action can be initiated against the controller or processor.

Notably, the CDPA clarifies that nothing within the CDPA should be construed as providing the basis for, or be subject to, a private right of action for violations under the CDPA or under any other law.

9.1 Enforcement decisions

Not applicable.