Effective January 1, 2026:  Indiana businesses that either control or process the personal data of at least 100,000 Indiana residents or derive over 50% of gross revenue from the sale of personal data and control or process personal data of 25,000 or more Indiana residents must outline the categories of data being processed, the categories of data being sold or shared, and the purpose, and provide consumers with information about exercising their consumer rights. Under the law, Indiana consumers will have rights of access, correct, deletion, and portability. They can also opt out of the sale of their personal data.

With the Indiana Consumer Data Protection Act, Indiana has now become the seventh U.S. state to pass a comprehensive privacy law. And it shares similarities with other privacy laws regarding rights and requirements. For example, it follows Iowa, Virginia, and Utah by defining “sale” as the exchange of personal data for “monetary consideration” rather than the broader definition from California’s and Connecticut’s laws, which include “monetary or other valuable consideration.” Further, similar to Colorado, Connecticut, and Virginia, an Indiana business must obtain consumer consent before processing sensitive information, rather than giving consumers the ability to opt-out, as with California’s law.

Click here for the full text. 

As Hire Image predicted in our Top Ten Background Screening Predictions for 2023, we will likely see similar privacy laws being passed this year, and these laws will undoubtedly impact background screening. Hire Image will continue to keep you updated as to the passage of additional privacy laws in other states.

Contact us if you have any questions about how this law may affect you or about your background screening processes in general.