In advance of the Indiana Consumer Data Protection Act’s (“Act”) effective date on January 1, 2026, the Indiana Attorney General released a Data Consumer Bill of Rights (“Bill of Rights”) that summarizes the rights created in the Act.

The Bill of Rights explains that consumers have certain rights under the Act, including:

• Right to Know: The Bill of Rights explains that consumers have a right to know if a controller is processing their data and to obtain a copy of the personal data the consumer has previously provided to a controller. The Bill of Rights also explains to consumers that controllers are required to publish a privacy notice with the categories of personal information collected, processed, and disclosed.

• Right to Control: The Bill of Rights categorizes several consumer rights under the group of “right to control.” Specifically, it details that consumers have the right to correct inaccuracies in personal data they previously provided to the controller and request the deletion of their personal data. Additionally, the Bill of Rights describes the right to portability as the right to “easily move [consumers’] personal data to different platforms.”

• Right to Protect:  Under the description “right to protect,” the Bill of Rights details consumers’ rights to opt-out of processing their personal data for targeted advertising, sale, or profiling for certain purposes. Additionally, the Bill of Rights states that consumers have the right to consent to the processing of their sensitive personal data.

• Right to Take Action: Consumers have the right to invoke and exercise their data privacy rights without discrimination and can appeal a controller’s decision to refuse a rights request.

Additionally, the Bill of Rights states that consumers have the right to have the collection of personal data limited to what is adequate, relevant and reasonably necessary to the purpose communicated by the controller and to consent to processing for purposes not reasonably necessary for nor compatible with the purpose communicated by the controller.

The Bill of Rights explains that consumers who believe a business has violated Indiana’s CDPA may submit a complaint to the Office of the Indiana Attorney General, including through the online portal available on the Attorney General’s website. The Act provides controllers or processors with a required 30-day cure period to resolve alleged violations. Indiana joins other states in publishing informal guidance ahead of 2026 privacy laws or updates taking effect. For example, the California Privacy Protection Agency recently released guidance on “7 Things to Know Before 2026 CCPA Updates Take Effect.”