Indiana Data Protection Law: Revenue-Based Applicability

The factor of Revenue-Based Applicability is used in determining the law's applicability by considering whether a data controller or processor derives a significant percentage of its revenue from the sale of personal data, specifically more than 50% of gross revenue from the sale of personal data of at least 25,000 Indiana residents.

Text of Relevant Provisions

ICDPA Ch.1(1)(a)(2):

"(a) This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year: (2) controls or processes personal data of at least twenty-five thousand (25,000) consumers who are Indiana residents and derives more than fifty percent (50%) of gross revenue from the sale of personal data."

Analysis of Provisions

The Indiana Consumer Data Protection Act (ICDPA) specifies that the law applies to entities that conduct business in Indiana or produce products or services targeted to Indiana residents and meet certain thresholds. Specifically, the law applies to entities that control or process personal data of at least 25,000 Indiana residents and derive more than 50% of their gross revenue from the sale of personal data.

This provision (ICDPA Ch.1(1)(a)(2)) indicates that the revenue-based applicability factor is a critical consideration in determining the law's scope. The law aims to regulate entities that are heavily reliant on the sale of personal data, ensuring that they are subject to the law's requirements.

Implications

The inclusion of this factor has significant implications for businesses in Indiana. For example, a company that processes personal data of 25,000 Indiana residents and derives more than 50% of its gross revenue from the sale of personal data would be subject to the law. Conversely, a company that processes personal data of fewer than 25,000 Indiana residents or derives less than 50% of its gross revenue from the sale of personal data would not be subject to the law.

For instance, a small business that processes personal data of 10,000 Indiana residents and derives 20% of its gross revenue from the sale of personal data would not be subject to the law. However, if the same business were to expand its operations and process personal data of 25,000 Indiana residents, deriving more than 50% of its gross revenue from the sale of personal data, it would be subject to the law.