Indiana CDPA

Indiana Consumer Data Protection Act - controller obligations, consumer rights.


Short name	IN CDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers IN CDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for IN CDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for IN CDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IN-CDPA-SEC` Data Security Practices	Controllers must establish, implement and maintain reasonable administrative, technical and physical data security practices appropriate to the volume and nature of the personal data; integrity-verifiable processing software evidences this duty (Ind. Code art. 24-15, controller-duties provisions)	Scan
`IN-CDPA-MIN` Minimisation Accountability	Collection must be limited to what is adequate, relevant and reasonably necessary for the disclosed purposes, which presumes an inventory of the software components that process consumer data (Ind. Code art. 24-15, controller-duties provisions)	Scan
`IN-CDPA-PROC` Processor Obligations	Processors act only under binding contracts specifying instructions, data categories and flow-down duties to subcontractors; named suppliers on third-party components demonstrate the required oversight (Ind. Code art. 24-15, processor provisions)	Scan
`IN-CDPA-DPIA` Data Protection Assessment Readiness	Data protection assessments are required for targeted advertising, sale, risky profiling and sensitive-data processing; assessment credibility depends on recorded versions of the processing software (Ind. Code art. 24-15, data protection assessment provisions)	Scan
`IN-CDPA-RIGHTS` Consumer Rights Fulfilment	Consumers may confirm processing, access, correct, delete and port personal data (or a representative summary) and opt out of targeted advertising, sale and profiling; systems holding the data must be unambiguously identifiable (Ind. Code art. 24-15, consumer-rights provisions)	Scan
`IN-CDPA-NOTICE` Privacy Notice Documentation	Controllers must provide a reasonably accessible, clear and meaningful privacy notice; supporting system documentation should carry document identity and a creation timestamp so disclosures remain auditable (Ind. Code art. 24-15, transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`IC-24-15-3-1`	Consumer Rights: Access, Correction, Deletion & Portability
`IC-24-15-4-1`	Opt-Out of Sale, Targeted Advertising & Profiling
`IC-24-15-5-1`	Sensitive Data: Opt-Out Model
`IC-24-15-6-1`	Data Protection Assessment
`IC-24-15-7-1`	Processor Agreements
`IC-24-15-2-1`	Privacy Notice
`IC-24-15-3-2`	Consumer Appeals
`IC-24-15-8-1`	Security & Data Minimization

Policy templates

Written for IN CDPA:

Indiana CDPA State Privacy Notice
Indiana CDPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to IN CDPA.