Indiana’s comprehensive consumer privacy law, the Indiana Consumer Data Protection Act (“ICDPA”), is set to take effect on January 1, 2026. Although the ICDPA shares many features with other comprehensive state privacy laws, several aspects set it apart as a more business-friendly law, including:
…
- Permanent Right to Cure: The ICDPA has a mandatory 30-day cure period that does not expire on a particular date, which is rare among state privacy laws.
- Higher Applicability Threshold: The ICDPA applies to for-profit businesses that conduct business in Indiana or produce goods or services targeted to residents of Indiana and that during a calendar year: (1) control or process the personal data of at least 100,000 or more Indiana residents; or (2) control or process the personal data of at least 25,000 Indiana residents and derive more than 50% of gross revenue from the sale of personal data. The law’s high applicability thresholds…