Privacy
Indiana Consumer Data Protection Act
The law applies to persons that conduct business in Indiana or produce products or services targeted to Indiana residents and that, during a calendar year, control or process personal data of at least 100,000 Indiana consumers. It also applies to persons that control or process personal data of at least 25,000 Indiana consumers and derive more than 50 percent of gross revenue from the sale of personal data. Government bodies, financial institutions and data subject to the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, public utilities, and certain insurance-fraud organizations are exempt.
What the website needs
- A covered controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose of processing, how consumers can exercise their rights and appeal a decision, the categories of personal data shared with third parties, and the categories of third parties with whom personal data is shared.
- A controller that sells personal data or uses it for targeted advertising must clearly and conspicuously disclose that activity and how a consumer can opt out.
- A controller must establish one or more secure and reliable means for consumers to submit requests, must describe them in the privacy notice, and may not require a consumer to create a new account.
- A controller may not process sensitive data without the consumer's consent, and sensitive data about a known child must be processed under the federal Children's Online Privacy Protection Act.
