Ind. Code ch. 24-15-4

in effect

Ind. Code § 24-15-4-1 Responsibilities of controller; discrimination against consumer for exercising consumer rights prohibited; processing of sensitive data

Sec. 1. Except as provided in IC 24-15-7-2, a controller has the following responsibilities: (1) A controller shall limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer. (2) Except as otherwise provided in this article, a controller shall not process personal data for purposes that are neither reasonably necessary for nor compatible with the disclosed purposes for which the personal data is processed, unless the controller obtains the consumer's consent. (3) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. The data security practices required under this subdivision must be appropriate to the volume and nature of the personal data at issue. (4) A controller shall not process personal data in violation of state and federal laws that prohibit unlawful discrimination against consumers. A controller shall not discriminate against a consumer for exercising any of the consumer rights set forth in this article, including by denying goods or services to the consumer, charging different prices or rates for goods and services, or providing a different level or quality of goods or services to the consumer. However, nothing in this subdivision shall be construed to: (A) require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain; or (B) prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer's right to opt out under IC 24-15-3-1(b)(5) or if the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discount, or club card program. (5) A controller shall not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. 6501 et seq.). As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-4-2 Contract provisions purporting to waive or limit consumer rights

Sec. 2. Any provision of a contract or agreement of any kind that purports to waive or limit in any way a consumer's rights under IC 24-15-3 is contrary to public policy and is void and unenforceable. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-4-3 Privacy notice to consumers; required elements

Sec. 3. A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes: (1) the categories of personal data processed by the controller; (2) the purpose for processing personal data; (3) how consumers may exercise their consumer rights under IC 24-15-3, including how a consumer may appeal a controller's decision with regard to the consumer's request; (4) the categories of personal data that the controller shares with third parties, if any; and (5) the categories of third parties, if any, with whom the controller shares personal data. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-4-4 Sale of personal data to third parties; use of personal data for targeted advertising; disclosure; consumer's right to opt out

Sec. 4. If a controller sells a consumer's personal data to third parties or uses a consumer's personal data for targeted advertising, the controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out of such sales or use. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-4-5 Exercise of rights by consumers; controller's duty to provide secure and reliable means for submitting requests

Sec. 5. A controller shall establish, and shall describe in a privacy notice provided under section 3 of this chapter, one (1) or more secure and reliable means for consumers to submit a request to exercise their rights under IC 24-15-3. Such means must take into account: (1) the ways in which consumers normally interact with the controller; (2) the need for the secure and reliable communication of such requests; and (3) the ability of the controller to authenticate the identity of the consumer making the request. A controller may not require a consumer to create a new account in order to exercise the consumer's rights under IC 24-15-3 but may require a consumer to use an existing account. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-4-6 Compliance by controllers; authority of attorney general to provide online resources for controllers

Sec. 6. The attorney general may maintain on the attorney general's website a list of resources for controllers, including sample privacy notices and disclosures, to assist controllers in complying with this chapter. As added by P.L.94-2023, SEC.1.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/24Fetched: 10/17/2026