IN SB 5 (2023) / IC 24-15
Applies to entities processing personal data of 100,000+ Indiana consumers, or 25,000+ consumers if 50%+ of revenue comes from data sales. Consumer rights: access, correct, delete, portability, opt-out of targeted advertising/profiling/data sales. Opt-in consent required for sensitive data. Data protection impact assessments required for high-risk processing. AG enforcement with 30-day cure period; civil penalties up to $7,500 per violation.