Indiana’s law allows companies to deny requests they consider excessive, but the burden of proof rests entirely on the business.
Indiana consumers have new control over their personal data with the Indiana Consumer Data Protection Act, which took effect on January 1st after businesses had three years to prepare for its new regulations. The law gives Hoosiers the right to see what data companies collect – correct it, delete it, or opt out of targeted ads and data sales. It also requires companies to clearly explain those rights.
Supporters say the law brings Indiana in line with other states. Critics noted that it includes broad exemptions, including nonprofits, government agencies, utilities, financial institutions, and health providers. The Attorney General’s office said their office will enforce the law and handle consumer complaints if companies deny valid requests.
Adam Berry, vice president of economic development and technology for the Indiana Chamber of Commerce, said businesses backed the measure for economic reasons. Berry said data rules help Indiana compete.
Companies generally must respond to data requests within 45 days, with one possible extension.