What to Know About Indiana’s New Data Protection Law

Government and regulatory partner Dori Cain and associate Mary Grace Smith co-authored an article explaining the Indiana Consumer Data Protection Act (ICDPA) and how it affects businesses operating in the state.

The co-authors noted that the ICDPA applies to businesses that process the personal data of either at least 100,000 Indiana residents or at least 25,000 residents and earn over half their revenue from selling personal data. The ICDPA requires businesses to minimize data collection by gathering only what is adequate, relevant and reasonably necessary for disclosed purposes, and businesses must establish and maintain reasonable administrative, technical and physical safeguards tailored to the volume and nature of the data they handle.

The co-authors advised businesses to take proactive steps, such as reviewing data tracking technology, updating privacy notices, and auditing data practices in order to ensure compliance with the ICDPA.