Get emailed when this bill changes status, is amended, or advances.
Disclaimer: This page provides general informational summaries only and does not constitute legal advice. AI-generated content may contain errors. Always consult a qualified attorney for guidance specific to your situation.
Read full disclaimer →
Indiana's HB1554 introduces consumer data protection measures, defining consumer rights and responsibilities for data controllers and processors. It mandates data protection assessments and requires data brokers to notify of breaches and register annually.
Key Provisions
Definitions of terms applicable throughout the article.
Exemptions for certain persons and data types.
Consumer rights regarding personal data.
Responsibilities of data controllers and processors.
Requirements for data protection assessments by controllers.
Requirements for processing de-identified or pseudonymous data.
Quarterly listing of consumers opting out of data sales by the attorney general's division.
Data brokers must notify of security breaches and register annually.
Attorney general's authority to investigate and enforce violations.
Preemption of local regulations on personal data processing.
Latest Legislative Action
First reading: referred to Committee on Commerce, Small Business and Economic Development
Bill Sponsors
Name
Role
District
Chris JeterR
Sponsor
HD-088
Compliance Checklist
Conduct data protection assessments Who: Data controllers Deadline: By January 1, 2024 Penalty: Potential enforcement actions by the attorney general
Register annually with the attorney general Who: Data brokers Deadline: By January 1, 2024 Penalty: Potential enforcement actions for non-compliance
HB1554, effective January 1, 2024, creates a new article in the Indiana Code focused on consumer data protection. It includes definitions applicable throughout the article and exemptions for certain persons and data types. The bill outlines consumer rights regarding their personal data and sets responsibilities for data controllers and processors. It requires controllers to conduct data protection assessments and specifies handling of de-identified and pseudonymous data. The attorney general's consumer protection division will maintain a quarterly list of consumers opting out of data sales. Data brokers must notify of security breaches and register annually with the attorney general. The attorney general is authorized to investigate violations, enforce the article, and issue interpretive guidance. The bill preempts local regulations on personal data processing.
We use cookies for analytics to understand how visitors use this site. We also use essential cookies for site functionality.
See our Privacy Policy for details.