Indiana Data Protection Law: Number of Data Subjects

The factor of Number of Data Subjects is used in determining the law's applicability by considering whether a data controller or processor processes personal data of a specified minimum number of consumers within a given time frame, typically a calendar year.

Text of Relevant Provisions

ICDPA Ch.1(1)(a)(1):

"(a) This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year: (1) controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents; or"

ICDPA Ch.1(1)(a)(2):

"(a) This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year: (2) controls or processes personal data of at least twenty-five thousand (25,000) consumers who are Indiana residents and derives more than fifty percent (50%) of gross revenue from the sale of personal data."

Analysis of Provisions

The Indiana Consumer Data Protection Act (ICDPA) specifies that the law applies to entities that conduct business in Indiana or produce products or services targeted to Indiana residents and meet certain thresholds regarding the number of data subjects. Specifically, the law applies to entities that control or process personal data of at least 100,000 Indiana residents or at least 25,000 Indiana residents and derive more than 50% of their gross revenue from the sale of personal data.

These provisions (ICDPA Ch.1(1)(a)(1) and (2)) indicate that the number of data subjects is a critical factor in determining the law's applicability. The law aims to protect the personal data of a significant number of consumers, ensuring that entities that process large amounts of personal data are subject to the law's requirements.

Implications

The inclusion of this factor has significant implications for businesses in Indiana. For example, a company that processes personal data of 100,000 Indiana residents would be subject to the law, regardless of whether they are physically located in Indiana or not. Similarly, a company that processes personal data of 25,000 Indiana residents and derives more than 50% of their gross revenue from the sale of personal data would also be subject to the law.

Conversely, a company that processes personal data of fewer than 25,000 Indiana residents and does not derive more than 50% of their gross revenue from the sale of personal data would not be subject to the law.

For instance, a small business that processes personal data of 10,000 Indiana residents and does not sell personal data would not be subject to the law. However, if the same business were to expand its operations and process personal data of 100,000 Indiana residents, they would be subject to the law.