Law note · Indiana
Indiana Consumer Data Protection Act (INCDPA), general applicability and controller duties
INCDPA governs private-sector processing of Indiana residents' personal data. It applies to a person conducting business in Indiana, or producing a product or service targeted to Indiana residents, that during a calendar year controls or processes the personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data.
A controller must limit collection to what is adequate, relevant, and reasonably necessary for the purposes disclosed to the consumer, and may not process personal data for an incompatible purpose without the consumer's consent. Article 15 also preempts local law: no city, county, or other local government may regulate a controller's or processor's processing of personal data.
What it asks of an app
- Determine whether you conduct business in Indiana, or produce a product or service targeted to Indiana residents, and control or process the personal data of at least 100,000 Indiana consumers, or at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data, before relying on INCDPA's scope in compliance planning.
- Limit the collection of personal data from an Indiana consumer to what is adequate, relevant, and reasonably necessary for the purposes disclosed to that consumer, and do not process it for an incompatible purpose without consent.
- Do not rely on a local Indiana ordinance to vary INCDPA. Article 15 preempts city, county, and other local law on the processing of personal data.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Indiana statute text, Indiana Code Article 15, Indiana General Assembly