Use Indiana consumer data rights

Check the effective date and your consumer role

The Attorney General says the Consumer Data Protection Act took effect January 1, 2026. Start by checking coverage before requesting action. Indiana Attorney General: consumer rights and request steps

The law covers Indiana residents acting for personal, family or household purposes. For businesses operating in Indiana or targeting residents, the annual tests are at least 100,000 Indiana consumers' data, or at least 25,000 plus more than half of gross revenue from personal-data sales. Employment and commercial contexts are outside the consumer definition. Indiana General Assembly: 2026 consumer data protection law

Check exclusions before assuming a business is covered

The Attorney General lists exclusions including government, financial institutions, HIPAA-covered organizations, nonprofits, higher education and public utilities. Meeting a size threshold alone does not establish coverage. Other exclusions also apply. Indiana Attorney General: consumer rights and request steps

Choose the request you actually need

Ask to confirm processing, correct inaccurate data previously provided, delete data provided by or obtained about you, or receive a portable copy or representative summary of previously provided data. The controller chooses copy or summary. Opt-outs cover targeted advertising, data sales and profiling supporting legally or similarly significant decisions. A copy or summary need not be provided more than once in 12 months. Indiana General Assembly: 2026 consumer data protection law

Use the business privacy notice and verification route

The Attorney General directs consumers to the company's designated request method. Identity verification may require additional information. A new account cannot be required, although an existing account may be used. Indiana Attorney General: consumer rights and request steps

Keep the request and appeal periods separate

A controller must respond within 45 days. One additional 45 days is allowed when reasonably necessary, with reasons and notice during the first period. Refusals require reasons and appeal instructions. An appeal needs a written outcome within 60 days; denial must include an Attorney General contact route. Indiana General Assembly: 2026 consumer data protection law

Expect limits rather than a universal erasure promise

The Attorney General describes exceptions for legal compliance, investigations, requested services and security. Requests are generally free, but excessive or repetitive requests can incur fees. Deletion is not unconditional. Indiana Attorney General: consumer rights and request steps

Follow up and locate the current complaint category

The Attorney General advises writing to a business that has neither responded nor notified an extension within 45 days. If it still fails to respond, the guide directs consumers to the office's complaint process. Indiana Attorney General: consumer rights and request steps

The current File a Complaint page lists a specific Consumer Data Privacy Act (CDPA) Complaint link. Read that category before choosing a general consumer or data-breach route. This page identifies the official route; it does not submit a complaint. Indiana Attorney General: current CDPA complaint route