The Indiana Consumer Data Protection Act (CDPA) took effect on January 1, 2026, and the Indiana Attorney General is now enforcing it through consumer complaints and proactive investigations. The law regulates how covered businesses collect, use, disclose, store, and analyze personal data of Indiana residents, with penalties up to $7,500 per violation. It applies to entities meeting specified data volume and revenue thresholds. Key compliance areas include clear privacy notices, consumer rights handling, data minimization, binding processor contracts, and conducting Data Protection Impact Assessments.
