Indiana § 24-15-1-1 Applicability to persons; exceptions

Indiana Statutes

§ 24-15-1-1 — Applicability to persons; exceptions

Indiana·Art. 15 CONSUMER DATA PROTECTION·Ch. 1 Applicability

Effective 1-1-2026. Sec. 1.

(a)This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:

(1)controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents; or

(2)controls or processes personal data of at least twenty-five thousand (25,000) consumers who are Indiana residents and derives more than fifty percent (50%) of gross revenue from the sale of personal data.

(b)This article does not apply to any of the following:

(1)Either of the following:

(A)The state, a state agency, or a body, authority, board, bureau, commission, district, or agency of any political subdivision of the state.

(B)A third party under contract

Free access — add to your briefcase to read the full text and ask questions with AI

Effective 1-1-2026.
Sec. 1. (a) This article applies to a person that
conducts business in Indiana or produces products or services that are
targeted to residents of Indiana and that during a calendar year:
(1) controls or processes personal data of at least one hundred
thousand (100,000) consumers who are Indiana residents; or
(2) controls or processes personal data of at least twenty-five
thousand (25,000) consumers who are Indiana residents and
derives more than fifty percent (50%) of gross revenue from the
sale of personal data.
(b) This article does not apply to any of the following:
(1) Either of the following:
(A) The state, a state agency, or a body, authority, board,
bureau, commission, district, or agency of any political
subdivision of the state.
(B) A third party under contract with an entity described in
clause (A), when acting on behalf of the entity. This clause does
not exempt data held or created by third parties outside of the
scope of the contract with the entity.
(2) Any financial institutions and affiliates, or data subject to Title
V of the federal Gramm-Leach-Bliley Act (15 U.S.C. 6801 et
seq.).
(3) Any covered entity or business associate governed by the
privacy, security, and breach notification rules issued by the
United States Department of Health and Human Services (45 CFR
Parts 160 and 164) pursuant to HIPAA.
(4) Any nonprofit organization.
(5) Any institution of higher education.
(6) Any public utility (as defined in IC 8-1-2-1(a)) or service
company affiliated with a public utility (as defined in IC 8-1-2-1(a)). For purposes of this subdivision, "service company"
means an associate company within a holding company system
organized specifically for the purpose of providing goods or
services to a public utility (as defined in IC 8-1-2-1(a)) in the
same holding company system.
(7) Any organization exempt from taxation under Section
501(c)(4) of the Internal Revenue Code that is:
(A) established to detect or prevent insurance related crime or
fraud; and
(B) subject to a memorandum of understanding with a statewide
law enforcement agency.