Material Applicability

The ICDPA's material scope is determined by the following factors:

• Number of Data Subjects
• Revenue-Based Applicability
• Government and Public Agency Exemption
• Central Bank and Financial Institutions Exclusion
• Sectoral Exceptions Regulated by Other Laws
• Exemption for Specific Purposes of Processing

Threshold Requirements

ICDPA Ch.1(1)(a):

"This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:(1) controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents; or(2) controls or processes personal data of at least twenty-five thousand (25,000) consumers who are Indiana residents and derives more than fifty percent (50%) of gross revenue from the sale of personal data."

The law applies to entities meeting either of these thresholds:

• Processing data of 100,000+ Indiana residents
• Processing data of 25,000+ Indiana residents while deriving over 50% of revenue from data sales

Exempted Entities

ICDPA Ch.1(1)(b):

"This article does not apply to any of the following:(1) The state, a state agency, or a body, authority, board, bureau, commission, district, or agency of any political subdivision of the state(2) Any financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act(3) Any covered entity or business associate governed by HIPAA"

The law excludes:

• Government entities and agencies
• Financial institutions under GLBA
• HIPAA-covered entities
• Nonprofit organizations
• Higher education institutions
• Public utilities

Exempted Data Categories

ICDPA Ch.1(2):

"The following information and data are exempt from this article:(1) Protected health information under HIPAA(9) Personal information [...] regulated by the federal Fair Credit Reporting Act(10) Personal data [...] under the federal Driver's Privacy Protection Act(11) Personal data regulated by the federal Family Educational Rights and Privacy Act"

The law exempts data already regulated by:

• HIPAA
• FCRA
• DPPA
• FERPA
• Farm Credit Act

Territorial Applicability

The ICDPA applies to entities that either:

• Conduct business in Indiana
• Produce products or services targeted to Indiana residents