Laws
Indiana Consumer Data Protection Act: your rights since January 1, 2026
Quick answer
Since January 1, 2026, Indiana's Consumer Data Protection Act lets you ask a covered company to show you, correct or delete your personal data, including data it got about you from other sources, and to stop selling it, using it for targeted ads or profiling you. The company has 45 days to answer and your first request each year is free. If it refuses, appeal to the company, then complain to the Indiana Attorney General.
All privacy laws“A consumer has the following rights: ... To delete personal data provided by or obtained about the consumer.”
- Applies in
- Indiana
- In force since
- Companies must answer within
- Without undue delay and within 45 days of receiving your request. The company can extend once by 45 days if it tells you why within the first 45 days (Ind. Code § 24-15-3-1(c)). Appeals get a written decision within 60 days (§ 24-15-3-1(d)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: iga.in.gov, secure.in.gov, in.gov
Last verified against the official page:
Indiana residents. The law applies to companies that do business in Indiana or target Hoosiers and, in a calendar year, handle the personal data of at least 100,000 Indiana consumers, or of at least 25,000 while making more than half their gross revenue from selling personal data. The state and local government, nonprofits, colleges, public utilities, HIPAA covered entities and financial institutions covered by the Gramm-Leach-Bliley Act are exempt, along with certain data covered by other laws.
Your rights
-
Confirm and access
Ask a company whether it processes your personal data, and see that data (Ind. Code § 24-15-3-1(b)(1)).
-
Correct
Have inaccurate personal data fixed, as long as it's data you gave the company (Ind. Code § 24-15-3-1(b)(2)).
-
Delete
Have a company delete personal data you gave it and data it obtained about you elsewhere. If it got your data from another source, it can comply by keeping a minimal record so the data stays deleted (Ind. Code § 24-15-3-1(b)(3), (c)(5)).
-
Copy or summary
Get a copy, or a representative summary if the company chooses, of the data you gave it, in a portable format. Once every 12 months (Ind. Code § 24-15-3-1(b)(4)).
-
Opt out
Stop the company using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects (Ind. Code § 24-15-3-1(b)(5)).
-
Appeal
Appeal a refusal. The company must answer in writing within 60 days and, if it still says no, give you a way to complain to the Attorney General (Ind. Code § 24-15-3-1(d)).
-
Consent for sensitive data
A company needs your consent before it processes sensitive data about you. All data about a known child counts as sensitive (Ind. Code § 24-15-4-1).
General information, not legal advice.
How to use it
- 1
Check the privacy notice
Covered companies must explain in their privacy notice how to use your rights and how to appeal. Use the method listed there; you can't be required to create a new account.
- 2
Ask for deletion, correction, access or an opt-out
Name the rights you want. A line like "Under the Indiana Consumer Data Protection Act, please delete the personal data you hold about me, including data you obtained from other sources" is enough to start.
- 3
Confirm your identity if asked
The company may ask for information that's reasonably necessary to confirm it's you.
- 4
Wait up to 45 days
The company has 45 days to respond and can extend once by 45 more if it tells you why. Your first request each year is free.
- 5
Appeal if the company refuses
Use the company's appeal process. It must answer in writing within 60 days.
- 6
Complain to the Indiana Attorney General
File a complaint with the Consumer Protection Division through the Attorney General's online complaint page. Only the Attorney General enforces the law: you can't sue under it yourself.
No answer in time? Complain to Indiana Attorney General, Consumer Protection Division .
Who has to follow Indiana's law
The law covers companies that do business in Indiana or target Hoosiers and handle data on at least 100,000 Indiana consumers a year. A company with data on 25,000 or more is covered too if over half its gross revenue comes from selling personal data.
Where Indiana is strong, and where it isn't
Deletion is the strong part. The right covers data "provided by or obtained about" you, so it reaches what a company bought from a data broker. The Attorney General's own guide says the right applies whatever the data's source. A company that got your data from somewhere else can keep a minimal record of you so the data isn't added back.
The weaker parts:
- Correction only covers data you provided. If a broker has a wrong address it bought elsewhere, this right doesn't reach it. Ask for deletion instead.
- Copy or summary is the company's choice. You may get a summary rather than the full data, and only once every 12 months.
- No browser opt-out signal. Companies don't have to honor Global Privacy Control, so each opt-out is a separate request.
- A permanent cure period. The Attorney General must give a company 30 days to fix a violation before suing, and that never runs out. Penalties are up to $7,500 per violation.
Why a company can say no
Exempt companies include government bodies, nonprofits, colleges, public utilities, HIPAA covered entities and financial institutions covered by the Gramm-Leach-Bliley Act (GLBA). Some data is exempt too, such as GLBA-covered financial data.
If a company cites an exemption, ask it which one, appeal, and complain to the Attorney General if you think it's wrong. Our guide on what to do when a company won't delete your data covers the next steps.
Where Serus fits
Indiana's deletion right is broad, but you still have to find each company that holds your data and write to it. Serus finds the data brokers that operate where you live, sends the deletion requests for you and watches for your data coming back. You can send the same requests yourself for free.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did Indiana's privacy law start?
January 1, 2026.
Can I delete data a company got from someone else?
Yes. The deletion right covers data provided by or obtained about you, and the Attorney General says it applies no matter where the data came from.
Will I get a full copy of my data?
Not necessarily. The company can choose to give you either a copy or a representative summary of the data you provided, once every 12 months.
Do Indiana businesses have to honor Global Privacy Control?
No. The law doesn't require companies to honor browser opt-out signals such as Global Privacy Control. Opt-outs are made by request to each company.
Can I sue?
No. The Attorney General has exclusive enforcement authority and there's no private right to sue.
Does a business get a chance to fix a violation?
Yes. The Attorney General must give 30 days' written notice and can't sue if the business fixes the problem and confirms it in writing. This cure period doesn't expire.
Sources
Something wrong or out of date? Tell us and we'll re-check it.