On April 11, the Indiana legislature passed comprehensive state privacy legislation in the form of S.B. 5. S.B. 5 shares similarities with the state privacy laws in Virginia, Connecticut, Colorado, Utah, and most recently Iowa.  If signed into law, S.B. 5 would take effect on January 1, 2026.  This blog post summarizes the statute’s key takeaways.

• Scope:  S.B. 5 would apply to controllers and processors that conduct business in Indiana or produce products or services that are targeted to Indiana residents and that during a calendar year either: (1) control or process personal data of at least 100,000 consumers or (2) control or process data of at least 25,000 Indiana consumers and derive more than 50% of their gross revenue from selling personal data.
• Consumer Rights:  Consumers have rights to: (1) confirm whether a controller is processing their personal data and access such personal data; (2) correct the personal data that the consumer previously provided to the controller; (3) delete personal data; (4) obtain a portable copy or representative summary of the consumer’s personal data and (5) opt-out of processing for purposes of (a) targeted advertising (defined as displaying ads that are selected based on the consumer’s activities over time and across nonaffiliated websites), (b) the sale of personal data (defined as the exchange of personal data for monetary consideration); or (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.  Notably, S.B. 5 limits its definition of “profiling” to “solely automated processing.”  
• Sensitive Data:  Controllers must obtain consent before processing a consumer’s sensitive data.  Sensitive data is defined as personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a health care provider, sexual orientation, or citizenship or immigration status; genetic or biometric data processed to identify individuals; personal data collected from a known child; and precise geolocation data (i.e., identifies a consumer within a radius of 1,750 ft.).  
• Controller & Processor Contracts:  S.B. 5 uses the terms “controller” and “processor.”  Under S.B 5, processors must assist controllers in meeting their obligations, including responding to consumer requests and conducting data protection impact assessments (“DPIAs”).  S.B. 5 would require certain contractual terms between controllers and processors, including those requiring the processor to maintain a duty of confidentiality.
• DPIAs:  S.B. 5 would require controllers to conduct DPIAs of processing activities that involve targeted advertising, the sale of personal data, profiling (in limited circumstances), sensitive data, or otherwise present a heightened risk of harm to consumers.  S.B. 5’s DPIA requirement does not apply retroactively.  
• Enforcement & Cure:  The Indiana Attorney General has the exclusive authority to enforce S.B. 5.  Further, the statute would provide controllers and processors with a 30-day cure period, which will not expire.