{"id":212007,"date":"2026-02-10T12:10:00","date_gmt":"2026-02-10T17:10:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/02\/10\/one-month-of-indianas-consumer-data-privacy-law-where-do-you-stand-on-compliance-mccarter-english-llp\/"},"modified":"2026-02-10T12:30:09","modified_gmt":"2026-02-10T17:30:09","slug":"one-month-of-indianas-consumer-data-privacy-law-where-do-you-stand-on-compliance-mccarter-english-llp","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/02\/10\/one-month-of-indianas-consumer-data-privacy-law-where-do-you-stand-on-compliance-mccarter-english-llp\/","title":{"rendered":"One Month of Indiana\u2019s Consumer Data Privacy Law . . . Where Do You Stand on Compliance? | McCarter & English, LLP"},"content":{"rendered":"

One Month of Indiana\u2019s Consumer Data Privacy Law . . . Where Do You Stand on Compliance? | McCarter & English, LLP<\/a><\/p>\n

https:\/\/www.jdsupra.com\/legalnews\/one-month-of-indiana-s-consumer-data-2950834\/<\/a><\/p>\n

Publish Date: 2026-02-10 12:10:00<\/a><\/p>\n

Source Domain: www.jdsupra.com<\/a><\/p>\n

Enforcement of the Indiana Consumer Data Protection Act (CDPA) has begun, and its penalties can add up quickly. The CDPA was signed in 2023 and became effective January 1, 2026. The law governs how covered businesses collect, use, disclose, store, and analyze \u201cpersonal data,\u201d i.e., nonpublic information linked or reasonably linkable to an identified or identifiable \u201cconsumer\u201d (under the CDPA, a \u201cconsumer\u201d is an Indiana resident acting for an individual, family, or household purpose).<\/p>\n

The Indiana attorney general, which will be enforcing the CDPA, has indicated it will be pursuing enforcement under two paths: consumer complaints and proactive investigations. The CDPA does not provide a private right of action; however, the attorney general may seek injunctive relief, impose civil penalties of up to $7,500 per violation, and recover investigation costs and attorneys\u2019 fees. Although the statute contemplates a 30-day cure period, the Indiana attorney general\u2019s office has indicated this safe harbor is only available for violations that can be cured, meaning some violations\u2014those deemed incurable\u2014may be subject to immediate enforcement.<\/p>\n

So how should your business approach compliance?<\/p>\n

The first step, of course, is to determine whether the law applies\u2014both to your business and to the data it processes. Even if your business is not incorporated or located in Indiana, the CDPA may apply if you (1) \u201cconduct[] business in Indiana\u201d or produce products or services targeted to Indiana residents and<\/strong> (2) meet one of the following thresholds during a calendar year:<\/p>\n