Law note · Indiana
Indiana Consumer Data Protection Act, consumer rights
INCDPA gives an Indiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.
A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available when reasonably necessary, and must inform the consumer of a decline and the means to appeal it on the same 45-day timeline. This is the ordinary 45-plus-45 response model used across most states in this wave, not the shortened timeline Florida uses.
What it asks of an app
- Give an Indiana consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer an Indiana consumer an opt-out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect.
- Respond to a consumer rights request without undue delay and no later than 45 days after receipt, with one 45-day extension available when reasonably necessary, and inform the consumer within that period of any extension and its reason.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Indiana statute text, Indiana Code Article 15, Indiana General Assembly