Indiana has now become the seventh US state to enact a comprehensive privacy law after Senate Bill 5 (“SB5”) was signed by the governor on May 1, 2023. The new law will go into effect January 1, 2026, and is almost identical to recent comprehensive privacy laws in other states.
The law will apply to those that do business in Indiana and either: (1) control or process personal data of at least 100,000 Hoosiers; or (2) derive over 50% of gross revenue from the sale of personal data and control or process personal data of 25,000 or more Hoosiers. Like most other states, it contains an exemption for entities covered by HIPAA or GLBA, and applies only to consumer (and not employee) information). Key provisions include:
