Indiana Consumer Data Protection Act exemptions: who is out of scope?

Indiana's Consumer Data Protection Act has been enforceable since 1 January 2026, and its exemption chapter is unusually generous at the entity level. If you are working out whether IC 24-15 reaches you, chapter 1 answers it: a threshold test at IC 24-15-1-1(a), six entity exemptions at IC 24-15-1-1(b), and a data list at IC 24-15-1-2.

The threshold

IC 24-15-1-1(a) applies the article to a person that conducts business in Indiana, or produces products or services targeted to Indiana residents, and that during a calendar year either controls or processes the personal data of at least 100,000 consumers who are Indiana residents, or controls or processes the personal data of at least 25,000 consumers who are Indiana residents and derives more than fifty percent of gross revenue from the sale of personal data.

There is no revenue-only branch. A company with substantial Indiana revenue but modest Indiana user numbers falls outside the article.

The six entity exemptions

IC 24-15-1-1(b) removes the following, and the exemptions attach to the organization rather than to particular data:

1. The state, a state agency, or a body, authority, board, bureau, commission, district, or agency of any political subdivision, and a third party under contract with such an entity when acting on its behalf. That clause carries a limit: it does not exempt data held or created by third parties outside the scope of the contract.
2. Financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act.
3. Any covered entity or business associate governed by the HHS privacy, security and breach notification rules at 45 CFR parts 160 and 164 pursuant to HIPAA.
4. Any nonprofit organization.
5. Any institution of higher education.
6. Any public utility as defined in IC 8-1-2-1(a), or a service company affiliated with one, meaning an associate company within a holding company system organized specifically to provide goods or services to a public utility in the same holding company system.

The utility exemption is the one that sets Indiana apart. Nebraska carves out electric suppliers and natural gas utilities specifically at Neb. Rev. Stat. Section 87-1103(2)(f) to (h); Indiana writes a broader category and extends it to affiliated service companies inside the same holding structure.

The data exemptions

IC 24-15-1-2 then exempts information rather than organizations. The list runs through protected health information under HIPAA and 45 CFR parts 160, 162 and 164; substance use disorder patient identifying information under 42 U.S.C. Section 290dd-2; identifiable private information in human subjects research under 45 CFR part 46 and 21 CFR parts 50 and 56; Health Care Quality Improvement Act documents; patient safety work product; de-identified health information; information intermingled so as to be indistinguishable from exempt information held by a covered entity or business associate; public health activity data; FCRA-regulated credit information; DPPA data; FERPA education records; Farm Credit Act data; and employment and applicant data.

What applies if nothing exempts you

The obligations are conventional, but two of Indiana's clocks are not. Under IC 24-15-3-1(c), a controller has 45 days from receipt to respond, with one conditional 45-day extension, and must decline within 45 days with a justification and appeal instructions. The information is free up to one time annually per consumer, which is narrower than the twice-annually standard in Iowa, Virginia and most other states. Appeals must be answered in writing within 60 days under IC 24-15-3-1(d), and a denial must come with an online mechanism or other method for contacting the Attorney General.

On enforcement, IC 24-15-10-1 gives the Attorney General exclusive authority, IC 24-15-10-2 allows injunctive relief plus a civil penalty not to exceed $7,500 for each violation and recovery of investigation expenses including attorney's fees, IC 24-15-10-3 provides a 30-day notice and cure period with no sunset, and IC 24-15-10-4 rules out a private right of action in broad terms. See the Indiana response deadline and Indiana fines and penalties pages for the detail, and the Indiana overview for the duties.

Indiana's permanent cure right is worth noting against the trend. Colorado repealed its general cure right, and Oregon's expired on 1 January 2026, the same day Indiana's law took effect. Indiana and Texas retain theirs with no sunset.

Next step

If you handle data about Indiana residents and are not sure whether an entity exemption covers you, the free 2-minute Obligation Scan runs the thresholds and both exemption lists and returns the duties that actually survive. The US state privacy laws hub sets Indiana beside the other enacted state laws.