Wednesday, May 3, 2023

FYI: Indiana Enacts Comprehensive Consumer Data Privacy Law

Indiana Gov. Eric Holcomb on May 1, 2023 signed into law Senate Bill 5, making Indiana the seventh state to enact a more comprehensive consumer data privacy law, following California, Virginia, Colorado, Utah, Connecticut, and Iowa.


The new Indiana law will take effect Jan. 1, 2026.




The new Indiana law applies to any person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:


  • controls or processes personal data of at least 100,000 consumers who are Indiana residents; or
  • controls or processes personal data of at least 25,000 consumers who are Indiana residents and derives more than 50% of gross revenue from the sale of personal data.




Importantly, the law exempts financial institutions and affiliates, or data subject to the Gramm-Leach-Bliley Act. Other exemptions include covered entities or business associates governed by the privacy, security, and breach notification rules issued pursuant to the Health Insurance Portability and Accountability Act, and the use of personal information to the extent the activity is regulated by and authorized under the Fair Credit Reporting Act.




Consumers are provided the right to:


  • confirm whether a controller is processing the consumer's personal data and to access such personal data;
  • correct inaccuracies in the consumer's personal data that the consumer previously provided to a controller;
  • delete personal data provided by or obtained about the consumer;
  • obtain a copy of the consumer's personal data, or a representative summary;
  • opt out of the sale of personal data.




A controller may not process "sensitive data" without a consumer's consent.


"Sensitive data" includes:


  • Personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a health care provider, sexual orientation, or citizenship or immigration status;
  • Genetic or biometric data;
  • Personal data collected from a known child;
  • Precise geolocation data.




A contract between a controller and a processor must include certain provisions to ensure that:


  • each person processing personal data is subject to a duty of confidentiality;
  • a processor will delete or return all personal data to the controller upon request;
  • a processor will provide a controller with all information necessary to demonstrate the processor's compliance;
  • a processor will allow, and cooperate with, reasonable assessments by the controller;
  • any subcontractor of the processor will meet the obligations of the processor pursuant to a written contract.




A controller must conduct and document a data protection impact assessment if the processing involves:


  • targeted advertising;
  • the sale of personal data;
  • certain profiling;
  • sensitive data;
  • activities posing a heighted risk of harm to consumers.




The Attorney General has the exclusive authority to enforce the law. Prior to taking any action, the Attorney General must provide a controller or processor 30 days to cure the violation. In the absence of a cure, civil penalties not to exceed $7,500 may be sought for each violation.




The law preempts "all rules, regulations, codes, ordinances, and other laws adopted by a city, county, city and county, municipality, or local agency regarding the processing of personal data by controllers or processors."




The Indiana law is very similar to the non-California data privacy laws recently enacted, so it should cause few additional compliance challenges.


Similar legislation will soon be eligible for the governors' signatures in Tennessee and Montana.




Ralph T. Wutscher
Maurice Wutscher LLP
The Loop Center Building
105 W. Madison Street, 6th Floor
Chicago, Illinois 60602
Direct:  (312) 551-9320
Fax: (312) 284-4751

Mobile:  (312) 493-0874


Admitted to practice law in Illinois




Alabama   |   California   |   Florida   |   Illinois   |   Massachusetts   |   New Jersey   |   New York   |   Ohio   |   Pennsylvania   |   Tennessee   |   Texas   |   Washington, DC



NOTICE: We do not send unsolicited emails. If you received this email in error, or if you wish to be removed from our update distribution list, please simply reply to this email and state your intention. Thank you.

Our updates and webinar presentations are available on the internet, in searchable format, at:


Financial Services Law Updates




The Consumer Financial Services Blog