September 2024

1. Governing Texts

1.1. Key acts, regulations, directives, bills

The Consumer Data Protection Act (CDPA) added to Indiana Code (Ind. Code) §24-15 was signed by the Governor of Indiana on May 1, 2023, and entered into effect on January 1, 2026. 

1.2. Guidelines

The Indiana Attorney General (AG) has not yet issued any guidance.

1.3. Case law

Not applicable.

2. Scope of Application

2.1. Personal scope

The CDPA is applicable to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year ( Ind. Code §24-15-1-1(a)):

• controls or processes personal data of at least 100,000 consumers who are Indiana residents; or
• controls or processes personal data of at least 25,000 consumers who are Indiana residents and derives more than 50% of gross revenue from the sale of personal data.

However, the CDPA clarifies that any state agency, or a body, authority, board, bureau, commission, district, or political subdivision of the state, as well as third parties acting on their behalf, financial institutions, affiliates of financial institutions, or data subject to the Gramm-Leach-Bliley Act of 1999 (GLBA) and persons subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA), are not subject to the CDPA (Ind. Code §24-15-1-1(b)).

Additionally, non-profit organizations, institutions of higher education, public utilities, and service companies affiliated with a public utility are outside the CDPA's scope (Ind. Code §24-15-1(b)).

2.2. Territorial scope

The CDPA applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana (Ind. Code §24-15-1-1(a)).

2.3. Material scope

Certain types of information are exempt under the CDPA, including (Ind. Code §24-15-1-2):

• protected health information under HIPAA;
• health records that are de-identified in accordance with the requirements for de-identification under HIPAA;
• the collection, maintenance, disclosure, sale, communication, or use of any personal information relating to consumers' credit information or mode of living by a consumer reporting agency, furnisher, or user that provides information for use in a consumer report, or by a user of a consumer report, only to the extent that such activity is regulated by, and authorized under, the Fair Credit Reporting Act of 1970 (FCRA) (15 U.S.C. 1681 et seq.); and/or
• data processed or maintained:
  • in the course of an individual applying to, employed by, or acting as an agent or independent contractor of a controller, processor, or third party, to the extent that the data is collected and used within the context of that role;
  • as the emergency contact information of an individual used for emergency contact purposes; and/or
  • that is necessary to retain to administer benefits for another individual relating to the individual under point one and used for the purposes of administering the same. 

Moreover, the CDPA does not apply to personal data in the context of purely personal or household activity (Ind. Code §24-15-8-5(2)).

3. Data Protection Authority | Regulatory Authority 

3.1. Main regulator for data protection

The AG is the regulator within Indiana (Ind. Code §24-15-10-1).

3.2. Main powers, duties and responsibilities

In accordance with Ind. Code §24-15-10-1, the AG will have exclusive authority to enforce the CDPA and may, whenever they have reasonable cause to believe that any person has engaged in, or is engaging in, or is about to engage in any violation of the CDPA, issue a civil investigative demand to investigate a suspected violation (Ind. Code §24-15-9-1).

The AG may not later than December 31, 2025, establish on the AG's website a list of resources for controllers, including sample privacy notices and disclosures, to assist controllers in compliance with the CDPA (Ind. Code §24-15-11-2(b)).

4. Key Definitions

Data controller: is defined as a person that, alone or jointly with others, determines the purpose and means of processing personal data (Ind. Code §24-15-2-9).

Data processor: is defined as a person that processes personal data on behalf of a controller (Ind. Code §24-15-2-22).

Personal data: is defined as information linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data, aggregate data, or publicly available information (Ind. Code §24-15-2-19).

Sensitive data: is defined as a category of personal data which includes (Ind. Code §24-15-2-28):

• racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a healthcare provider, sexual orientation, citizenship, or immigration status;
• genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual;
• personal data collected from a known child; and
• precise geolocation data.

Health data: The CDPA does not provide a definition for 'health data.'

Biometric data: is defined as data that is generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, images of the retina or iris, or other unique biological patterns or characteristics, and is used to identify a specific individual. Biometric data does not include (Ind. Code §24-15-2-4):

• a physical or digital photograph, or data generated from a physical or digital photograph;
• a video or audio recording, or data generated from a video or audio recording; or
• information collected, used, or stored for health care treatment, payment, or operations under HIPAA.

Pseudonymization: The CDPA defines 'pseudonymous data' as personal data that cannot be attributed to a specific individual because additional information that would allow the data to be attributed to a specific individual is (Ind. Code §24-15-2-25):

• kept separately; and
• subject to appropriate technical and organizational measures;

to ensure that the personal data is not attributed to an identified or identifiable individual.

Data subject: The CDPA does not provide a definition for 'data subject'; however, 'consumer' is defined as an individual who is a resident of Indiana acting only for a personal, family, or household context, excluding an individual acting in a commercial or employment context (Ind. Code §24-15-2-8).

5. Legal Bases

The CDPA also notes that personal data processed by a controller for a purpose authorized under Chapter 8 of the CDPA may be processed to the extent that such processing is (Ind. Code §24-15-8-7(a) and (b)):

• reasonably necessary and proportionate to the purposes listed;
• adequate, relevant, and limited to what is necessary in relation to the specific purposes listed in this section;
• personal data collected, used, or retained under §2 of Chapter 8, where applicable, takes into account the nature and purpose or purposes of such collection, use, or retention; and
• subject to reasonable administrative, technical, and physical measures to protect the confidentiality, integrity, and accessibility of the personal data.

If a controller processes personal data pursuant to an exemption under Chapter 8, the controller bears the burden of demonstrating that such processing qualifies for the exemption and complies with the requirements set forth in §24-15-8-7 (Ind. Code §24-15-8-7(c)).

The CDPA clarifies that processing personal data for a purpose expressly identified in §24-15-8-1(a)(1) - (a)(9) does not, by itself, make a person a controller with respect to such processing (Ind. Code §24-15-8-1(b)).

5.1. Consent

The CDPA provides that nothing provided within may restrict a controller or processor's ability to provide products or services specifically requested by a consumer, perform a contract to which the consumer, or a parent of a child, is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent before entering into a contract (Ind. Code §24-15-8-1(a)(5)).

Followingly, the CDPA provides that the obligations imposed on a controller or processor under its provisions will not restrict the controller's or processor's ability to collect, use, or retain data to perform internal operations that are (Ind. Code §24-15-8-2(4)):

• reasonably aligned with the expectations of the consumer;
• reasonably anticipated based on the consumer's existing relationship with the controller; or
• are otherwise compatible with:
  • processing data in furtherance of the provision of a product or service specifically requested by a consumer, or parent or guardian of a child; or
  • the performance of a contract to which any of the same is a party.

5.2. Contract with the data subject

The CDPA provides that nothing provided within may restrict a controller or processor's ability to provide products or services specifically requested by a consumer, perform a contract to which the consumer, or a parent of a child, is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent before entering into a contract (Ind. Code §24-15-8-1(a)(5)).

5.3. Legal obligations

The CDPA also provides that nothing provided within may restrict the ability of controllers or processors to:

• comply with federal, state, or local laws, rules, or regulations (Ind. Code §24-15-8-1(a)(1));
• comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities (Ind. Code §24-15-8-1(a)(2));
• cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations (Ind. Code §24-15-8-1(a)(3)); or
• investigate, establish, exercise, prepare, or defend legal claims (Ind. Code §24-15-8-1(a)(4)).

5.4. Interests of the data subject

The CDPA also provides that nothing within may restrict the ability of controllers or processors to take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person and where the processing cannot be manifestly based on another legal basis (Ind. Code §24-15-8-1(a)(6)). 

5.5. Public interest

The CDPA also provides that nothing within the CDPA may restrict the ability of controllers or processors to engage in public or peer-reviewed scientific or statistical research that is in the public interest that adheres to all applicable ethics and privacy laws, and is approved, monitored, and governed by an institutional review board, or similar independent oversight entities that determine the following (Ind. Code §24-15-8-1(a)(8)):

• if the information is likely to provide substantial benefits that do not exclusively accrue to the controller;
• if the expected benefits of the research outweigh the privacy risks; or
• if the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with re-identification.

5.6. Legitimate interests of the data controller

The CDPA does not explicitly address the legitimate interest of the controller.

However, the CDPA provides that nothing within may restrict the ability of controllers or processors to (Ind. Code §24-15-8-1(a)(7) and (9)):

• prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, investigate, report, or prosecute those responsible for any such action, and preserve the integrity or security of systems; and
• assist another controller, processor, or third party with any obligation described in §1 Chapter 8 of the CDPA.

Additionally, the CDPA provides that the obligations imposed on a controller or processor under its provisions will not restrict the controller's or processor's ability to collect, use, or retain data to (Ind. Code §24-15-8-2):

• conduct internal research to develop, improve, or repair products, services, or technology;
• effectuate a product recall; and
• identify and repair technical errors that impair existing or intended functionality.

5.7. Legal bases in other instances

The obligations imposed on controllers or processors under the CDPA will not apply where compliance by the controller or processor would violate an evidentiary privilege under the laws of the state. However, nothing with the CDPA should be construed to prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under the laws of the state as part of a privileged communication (Ind. Code §24-15-5-8(3)).

Furthermore, the CDPA should not be construed as an obligation imposed on controllers and processors that adversely affects the rights or freedoms of any persons, such as exercising the right of free speech under the First Amendment to the Constitution of the United States, and does not apply to personal data in the context of a purely personal or household activity (Ind. Code §24-15-8-5). The CDPA should also not be construed as requiring a controller to disclose trade secrets (Ind. Code §24-15-8-6).

6. Principles

The CDPA specifies that controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer (Ind. Code §24-15-4-1(1)). Additionally, except as otherwise provided in the CDPA, controllers must not process personal data for purposes that are neither reasonably necessary for nor compatible with the disclosed purposes for which the personal data is processed unless the consumer's consent is obtained (Ind. Code §24-15-4-1(2)).

Furthermore, controllers must adopt and implement reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and availability of personal data. On this point, the CDPA stipulates that such practices should be appropriate to the volume and nature of the personal data at issue (Ind. Code §24-15-4-1(3)).

A controller shall not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers (Ind. Code §24-15-4-1(4)).

However, the responsibilities of a controller, as stated above, do not apply to pseudonymous data in any case in which the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information (Ind. Code §24-15-7-2(2)).

7. Controller and Processor Obligations

De-identified and pseudonymous data

In particular, the CDPA specifies that a controller processing de-identified data must (Ind. Code §24-15-7-1(a)):

• take reasonable measures to ensure the data cannot be associated with an individual;
• publicly commit to maintaining and using de-identified data without attempting to re-identify the data; and
• contractually obligate recipients of the de-identified data to comply with all provisions of the CDPA.

However, the CDPA clarifies that Chapter 7 will not be construed to require a controller or processor to (Ind. Code §24-15-7-1(b)):

• re-identify de-identified data or pseudonymous data;
• maintain data in the identifiable form; or
• collect, obtain, retain, or access any data or technology in order to be capable of associating an authenticated consumer request with personal data.

Furthermore, a controller that discloses de-identified or pseudonymous data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data is subject and must take appropriate steps to address any breaches of those contractual commitments (Ind. Code §24-15-7-3).

7.1. Data processing notification

 The CDPA does not specifically provide for data processing notification.

7.2. Data transfers

The CDPA does not specifically address data transfers but defines the 'sale of personal data' as the exchange of personal data for monetary consideration by the controller to a third party, noting that this does not include (Ind. Code §24-15-2-27):

• the disclosure of personal data to a processor that processes the personal data on behalf of the controller;
• the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer or a parent of a child to whom the personal data pertains;
• the disclosure or transfer of personal data to an affiliate of the controller;
• the disclosure of information that the consumer intentionally made available to the general public via a channel of mass media and did not restrict to a specific audience; or
• the disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.

Furthermore, the CDPA stipulates that a controller or processor that discloses personal data to a processor or third-party controller in accordance with the CDPA shall not be deemed to have violated said law if the processor or third-party controller that receives and processes such personal data violates said law provided, at the time the disclosing controller or processor disclosed such personal data, the disclosing controller or processor did not have actual knowledge that the receiving processor or third-party controller would violate said sections data. In addition, a third-party controller or processor receiving personal data from a controller or processor in compliance with CDPA is likewise not in violation of said law for the transgressions of the controller or processor from which such third-party controller or processor receives such personal data (Ind. Code §24-15-8-4).

7.3. Data processing records

The CDPA does not address data processing records.

7.4. Data protection impact assessment

Processors are obliged to provide necessary information to enable the controller to conduct and document data protection impact assessments (DPIAs) (Ind. Code §24-15-5-1)

The CDPA requires controllers to conduct and document DPIAs for the following processing activities involving personal data (Ind. Code §24-15-6-1(b)):

• the processing of personal data for targeted advertising;
• the sale of personal data;
• the processing of personal data for purposes of profiling if such profiling presents a reasonably foreseeable risk of:
  • unfair or deceptive treatment of, or unlawful disparate impact on, consumers;
  • financial, physical, or reputational injury to consumers;
  • a physical or other intrusions upon the solitude or seclusion, or the private affairs or concerns, of consumers, if such intrusion would be offensive to a reasonable person; or
  • other substantial injuries to consumers;
• the processing of sensitive data; and
• any processing activities involving personal data that present a heightened risk of harm to consumers.

Importantly, the CDPA specifies that this requirement is applicable to processing activities created or generated after December 31, 2025, and does not apply retrospectively to any processing activity commenced before January 1, 2026 (Ind. Code §24-15-6-1(a)).

Method

A single DPIA may address a comparable set of processing operations that include similar activities (Ind. Code §24-15-6-1(d)). With regard to the manner in which DPIAs must be conducted, the CDPA outlines that DPIAs must identify and weigh the direct and indirect benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks. In this regard, the use of de-identified data, the reasonable expectations of consumers, and the context of the processing and the relationship between the controller and the consumer shall be factored into such an assessment (Ind. Code §24-15-6-1(c)).

A DPIA conducted by a controller for the purpose of compliance with other laws or regulations may be used to comply with this section if the assessment has a reasonably comparable scope and effect to an assessment conducted under the CDPA (Ind. Code §24-15-6-1(e)).

AG powers

The AG may request a controller disclose a DPIA that is relevant to an investigation it is conducting. Upon receipt of such a request, the controller must make the DPIA available to the AG (Ind. Code §24-15-6-2(a)). The AG may also evaluate the DPIA for a controller's compliance with the responsibilities set forth in the CDPA. Nevertheless, the CDPA confirms that DPIAs are confidential and exempt from public inspection and copying (Ind. Code §24-15-6-2(a)).

7.5. Data protection officer appointment

The CDPA does not address the appointment of data protection officers.

7.6. Data breach notification

The CDPA does not provide breach notification requirements. However, there are data breach requirements outlined under §24-4.9-1 et seq. of the Ind. Code.  

For further information, see Indiana – Data Breach.

7.7. Data retention

The CDPA does not specifically address data retention requirements.

7.8. Children's data

The CDPA defines ‘child’ as any individual who is less than 13 years of age (Ind. Code §24-15-2-6).

The CDPA classifies personal data collection from a known child as 'sensitive data' and further notes that in the case of a known child, controllers must process sensitive data in accordance with the Children's Online Privacy Protection Act of 1998 (COPPA) (Ind. Code §24-15-2-28 and §24-15-4-1(5)).

Specifically, the CDPA emphasizes that the controller shall not process sensitive data concerning a known child without processing such data in accordance with COPPA, except as otherwise provided in the CDPA (Ind. Code §24-15-4-1(5)).

In the same vein, a controller or a processor that complies with COPPA and its implementing rules or regulations satisfies any obligation to obtain parental consent under the CDPA (Ind. Code §24-15-1-3).

Additionally, the CDPA provides that a known child's parent or legal guardian may invoke consumer rights on behalf of the known child regarding processing personal data belonging to the child (Ind. Code §24-15-3-1(a)).

7.9. Special categories of personal data

With regard to sensitive data, controllers must not process sensitive data concerning a consumer without obtaining the consumer's consent (Ind. Code §24-15-4-1(5)).

In the case of processing of sensitive data, the controller is required to conduct and document a data privacy and protection assessment (Ind. Code §24-15-6-1(b)(4)).

7.10. Controller and processor contracts

The CDPA provides that controller/processor relationships must be governed by a binding contract with respect to the processing activities conducted by the processor on behalf of the controller. In this regard, the CDPA specifies that such a contract must set forth the instructions for processing personal data, the nature and purpose of processing, the duration of the processing, the type of data subject to processing, and the rights and duties of both parties. Controller processor contracts under the CDPA must (Ind. Code §24-15-5-2(a)):

• ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;
• at the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services unless retention of the personal data is required by law;
• upon the reasonable request of the controller, make available to the controller all information in the processor's possession necessary to demonstrate the processor's compliance with the obligations in the CDPA;
• allow, and cooperate with, reasonable assessments by the controller or their designated assessor - alternatively, the processor may arrange for a qualified and independent assessor to conduct the assessment of its policies and technical and organizational measures, which must be reported to the controller upon request; and
• engage any subcontractor or agent pursuant to a written contract that requires the subcontractor to meet the duties of the processor with respect to personal data.

Additionally, the CDPA notes that processors must adhere to the instructions of controllers and assist the same in meeting its obligations under the CDPA, which includes the following (Ind. Code §24-15-5-1):

• assisting the controller in meeting its obligation to respond to consumer rights requests by appropriate technical and organizational measures, insofar as this is reasonably practicable, and taking into account the nature of processing and the information available to the processor; and
• taking into account the nature of processing and the information available to the processor, assisting the controller in meeting its obligations in relation to:
  • the security of processing personal data; and
  • the notification of a breach of security of the processor's system; and
• providing necessary information to enable the controller to conduct and document a DPIA.

In determining whether a person is acting as a controller or processor with respect to specific processing of data, the CDPA explains that it is a fact-based determination that depends upon the context in which personal data is to be processed. To this end, a processor that continues to adhere to a controller's instructions with respect to the specific processing of personal data remains a processor (Ind. Code §24-15-5-3).

Importantly, the CDPA clarifies that nothing will be construed to relieve a controller or a processor from the liabilities-imposed controller or processor by virtue of its role in the processing relationship (Ind. Code §24-15-5-2(b)).

Furthermore, with regard to the processing of de-identified or pseudonymous data, a controller that discloses any such data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the pseudonymous data or de-identified data is subject and must take appropriate steps to address any breaches of those contractual commitments (Ind. Code §24-15-7-3).

8. Data Subject Rights

The CDPA establishes consumer rights that may be invoked at any time by submitting a request to the controller. These rights can also be invoked by a known child's parent or legal guardian on behalf of the known child regarding the processing of data belonging to the child. Subsequently, a controller must comply with an authenticated consumer request to exercise any such rights (Ind. Code §24-15-3-1(a)).

Additionally, the CDPA provides that a controller must not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers, noting that a controller shall not discriminate against a consumer for exercising any consumer rights, including by denying goods or services to the consumer, charging different prices or rates for goods and services, or providing a different level or quality of goods or services to the consumer (Ind. Code §24-15-4-1(4)). This section of the CDPA does not:

• require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain (Ind. Code §24-15-4-1(4)(A)); or
• prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer's right to opt out or if the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discount, or club card program (Ind. Code §24-15-4-1(4)(B)).

Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer's rights is contrary to public policy and is void and unenforceable §24-15-4-2).

Submission format

Under the CDPA, controllers must provide one or more secure and reliable means for consumers to submit a request to exercise their consumer rights, taking into account the ways in which consumers interact with the controller and the need for secure and reliable communication of the requests. A controller may not require a consumer to create a new account to exercise a right but may require a consumer to use an existing account (Ind. Code §24-15-4-5).

Response time

In line with the above, the CDPA establishes provisions for complying with consumer rights requests, providing that controllers must respond to consumers without undue delay and, in any case, no later than 45 days after receipt of a request. The timeframe for a response may be extended once by an additional 45 days when reasonably necessary, considering the complexity and number of consumer requests. However, in such cases, the consumer must be informed of such an extension within the original 45-day timeframe, together with the reason for the extension (Ind. Code §24-15-3-1(c)(1)). Equally, the CDPA stipulates that controllers must inform data subjects without undue delay when declining to take action within the same timeframe, along with the reason for declining to take action and instructions on how to appeal the decision (Ind. Code §24-15-3-1(c)(12)).

Fee

Information provided in response to a consumer request shall be provided by a controller free of charge, up to once annually per consumer. Where requests from a consumer are manifestly unfounded, excessive, or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. Importantly, the controller bears the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request (Ind. Code §24-15-3-1(c)(3)).

Authentication

A controller or processor is not required to comply with an authenticated consumer rights request where the conditions below are met:

• the controller is not reasonably capable of associating the request with personal data, or it would be unreasonably burdensome for the controller to associate the request with personal data;
• the controller does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and
• the controller does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor except as otherwise permitted by the CDPA (Ind. Code §24-15-4-5).

In the case where a controller is unable to authenticate the request using commercially reasonable efforts, the controller is not required to comply with a request to initiate an action and may request that the consumer provide additional information reasonably necessary to authenticate the consumer and the consumer's request (Ind. Code §24-15-3-1(c)(4)).

Declining requests and appeals

A controller or processor is not required to comply with an authenticated consumer rights request where the conditions below are met (Ind. Code §24-15-3-1(a)):

• the controller is not reasonably capable of associating the request with personal data, or it would be unreasonably burdensome for the controller to associate the request with personal data;
• the controller does not use the personal data to recognize or respond to the specific consumer who is the subject of the personal data or associate the personal data with other personal data about the same specific consumer; and
• the controller does not sell the personal data to any third party or otherwise voluntarily disclose the personal data to any third party other than a processor except as otherwise permitted by the CDPA.

Appeals

Importantly, the CDPA stipulates that the controller is responsible for establishing a process for a consumer to appeal refusals within a reasonable period of time after the consumer receives such a decision from the controller. This appeal process must be conspicuously available and similar to the process for submitting requests to invoke a right (Ind. Code §24-15-3-1(d)).

Within 60 days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, the controller shall also provide the consumer with an online mechanism, if available, or other methods through which the consumer may contact the attorney general to submit a complaint (Ind. Code §24-15-3-1(d)).

Exemptions

The CDPA highlights that Chapter 7 of the CDPA does not require a controller or processor to comply with a request from a consumer in certain circumstances, stipulating that consumer rights and controller responsibilities do not apply to pseudonymous data in any case in which the controller is able to demonstrate that any information necessary to identify the consumer is kept separately and is subject to effective technical and organizational controls that prevent the controller from accessing such information (Ind. Code §24-15-7-2).

8.1. Right to be informed

Consumers have the right to confirm whether or not a controller is processing personal data concerning the consumer (Ind. Code §24-15-3-1(b)(1)).

Furthermore, if a controller sells a consumer's personal data to third parties or uses a consumer's personal data for targeted advertising, the controller must clearly and conspicuously disclose such activity to the consumer (Ind. Code §24-15-4-4).

Privacy notices

The CDPA outlines that controllers must provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes (Ind. Code §24-15-4-3):

• the categories of personal data processed by the controller;
• the purpose for processing personal data;
• how consumers may exercise their consumer rights under the CDPA, including how a consumer may appeal a controller's decision with regard to the consumer's request;
• the categories of personal data that the controller shares with third parties, if any; and
• the categories of third parties, if any, with whom the controller shares personal data.

Specifically, on consumer rights, the CDPA specifies that controllers must establish and describe in a privacy notice one or more secure and reliable means for consumers to submit a request to exercise their rights. Such means must take into account (Ind. Code §24-15-4-5):

• the ways in which consumers normally interact with the controller;
• the need for the secure and reliable communication of such requests; and
• the ability of the controller to authenticate the identity of the consumer making the request.

8.2. Right to access

The CDPA provides consumers with the right to access their personal data (Ind. Code §24-15-3-1(b)(1)).

8.3. Right to rectification

The CDPA provides consumers with the right to correct inaccuracies in their personal data (Ind. Code §24-15-3-1(b)(2)).

In this regard, the CDPA highlights that upon receiving such a request from a consumer, a controller shall correct inaccurate data as requested by the consumer, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data (Ind. Code §24-15-3-1(b)(2)).

8.4. Right to erasure

The CDPA provides consumers with the right to delete personal data provided by or obtained about the consumer (Ind. Code §24-15-3-1(b)(3)).

Furthermore, in relation to information obtained from a source other than the consumer, the CDPA specifies that a controller is considered to comply with a deletion request if it (Ind. Code §24-15-3-1(c)(5)):

• retains:
  • a record of the consumer's request for deletion; and
  • the minimum data necessary to ensure that the consumer's personal data remains deleted from the controller's records; and
• does not use the data retained above for any other purpose.

8.5. Right to object/opt-out

The CDPA provides consumers with the right to opt out of the processing of personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer (Ind. Code §24-15-3-1(b)(5)). These are decisions made by a controller that results in the provision or denial by the controller of:

• financial and lending services;
• housing;
• insurance;
• education enrollment;
• criminal justice;
• employment opportunities;
• health care services; or
• access to basic necessities, such as food and water (Ind. Code §24-15-3-1(b)(5)).

8.6. Right to data portability

The CDPA provides for the right to obtain a copy or a representative summary of a consumer's personal data that they previously provided to the controller, in a portable, to the extent technically practicable, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means. The controller has the discretion to send either a copy or a representative summary of the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data (Ind. Code §24-15-3-1(b)(4)).

8.7. Right not to be subject to automated decision-making

The CDPA does not expressly provide for the right not to be subject to automated decision-making. However, it defines 'profiling' as any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health or health records, personal preferences, interests, reliability, behavior, location, or movements (Ind. Code §24-15-2-23).

As such, as far as automated decision-making falls within the definition of 'profiling', consumers have the right to opt out of such a processing activity, as mentioned in the section on the right to opt-out above.  

8.8. Other rights

Not applicable.

9. Penalties

The CDPA outlines that the AG has exclusive authority to enforce the CDPA's provisions  (Ind. Code §24-15-10-1). Accordingly, the AG may bring an action in the name of the state and seek an injunction to restrain any violations of the CDPA and/or a civil penalty that does not exceed $7,500 for each violation (Ind. Code §24-15-10-2(a)).

Importantly, the AG must provide controllers or processors 30 days written notice identifying the provisions of the CDPA alleged to, or that have been violated, before initiating any action. If, within 30 days, the controller or processor rectifies the aforementioned violation and provides the AG with an express written statement that the alleged violations have been resolved and that no further violations shall occur, no action can be initiated against the controller or processor (Ind. Code §24-15-10-3(a)). However, if the controller or processor continues the alleged violation after 30 days or breaches an express written statement provided to the AG, then the AG can initiate an action as indicated above (Ind. Code §24-15-10-3(b)).

Notably, the CDPA clarifies that nothing within the CDPA should be construed as providing the basis for, or be subject to, a private right of action for violations under the CDPA or under any other law (Ind. Code §24-15-10-4).

9.1 Enforcement decisions

Not applicable.