How long does a business have to respond to an Indiana privacy request?

Indiana's Consumer Data Protection Act took effect on January 1, 2026, almost three years after it was signed. The long runway means a lot of the guidance written about it was written in the abstract. Now that it is live, two of its details differ from the multi-state template most privacy programs are built on.

The 45-day clock, and the extension

IC 24-15-3-1(c)(1) requires a controller to comply with a consumer request within 45 days after receipt of the request. The response period may be extended once by an additional 45 days when reasonably necessary, taking into account the complexity and number of the consumer's requests.

The extension is conditional on telling the consumer within the initial period. That is the same shape as Texas, Nebraska, Oregon and Colorado, and the same failure mode applies: a controller that simply answers late has not taken an extension, it has missed a deadline.

Refusals are due on the same schedule

If the controller declines to act, IC 24-15-3-1(c)(2) requires it to inform the consumer within 45 days after receipt of the request of the justification for declining, and to provide instructions for how to appeal the decision.

The instructions are not optional garnish. They are the thing that makes the appeal right usable, and their absence is a separate defect from the refusal itself.

The first difference: one free request a year, not two

Most state privacy laws give a consumer two free responses in a twelve-month period. Indiana gives one. IC 24-15-3-1(c)(3) requires information provided in response to a consumer request to be provided free of charge up to one time annually per consumer.

If your request tooling has a hard-coded "two free per year" rule inherited from a Virginia or Nebraska implementation, Indiana is stricter than your default in one direction and more permissive in another, and neither is a safe assumption to leave unexamined.

The second difference: 60 days for appeals

IC 24-15-3-1(d) lets a consumer appeal a refusal within a reasonable period after receiving the decision. Within 60 days of receiving the appeal, the controller must inform the consumer in writing of any action taken or not taken, including a written explanation of the reasons for the decision.

Sixty days matches Texas, Nebraska and Virginia. It does not match Oregon, which allows 45, or Colorado, which allows 45 with a further 60-day extension. There is no single appeal timer that is correct across states, which is the argument for tracking the deadline per jurisdiction rather than per process.

The escalation path you have to hand over

If the appeal is denied, the controller shall also provide the consumer with an online mechanism, if available, or another method through which the consumer may contact the attorney general to submit a complaint.

Indiana, like Texas, requires the business to tell a rejected consumer how to complain about it to the regulator. It is worth putting that line into the denial template rather than trusting that someone will remember it.

Who this applies to

IC 24-15-1-1 covers a person that conducts business in Indiana, or produces products or services targeted to Indiana residents, and during a calendar year controls or processes the personal data of at least 100,000 Indiana consumers, or at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from the sale of personal data.

The 50 percent revenue trigger is worth noting. Several states set that gate at 25 percent, so a data-heavy business can be in scope in Oregon and out of scope in Indiana on identical numbers.

Next step

Indiana is the newest live state program, which means most competitor content about it is still written in the future tense. The free 2-minute Obligation Scan tells you whether Indiana applies to your business and which deadlines you are on. See the Indiana Consumer Data Protection Act overview for applicability, Indiana fines and penalties for the enforcement side, and privacy request response deadlines by state to compare the clocks.