INDIANAPOLIS – A new state law will give Hoosiers more power over how companies use their personal information.
Senate Enrolled Act 5 takes effect in 2026. Under the law, Hoosiers will be able to ask certain companies for a copy of the data on them that has been collected, correct inaccuracies and have their personal information deleted.
Indiana is the seventh state in the country to pass such a law.
“If you don’t want to have your information collected on a specific site just to be able to use that service, now you’re going to be able to basically uncheck that box as easy as it was to check in the first place,” said Scott Shackelford, executive director of the IU Center for Applied Cybersecurity Research. “So those are all really big deals.”
There is little federal regulation over how companies handle people’s personal data, which is commonly sold for marketing purposes, Shackelford said.
“The Federal Trade Commission, for example, estimates that the average data broker has several thousand pieces of our personally identifiable information,” he said.
The law mainly applies to larger businesses. That includes companies that control or process personal data of at least 100,000 Indiana residents or process personal data of at least 25,000 Hoosiers and obtain more than half their gross revenue from selling that information.
The Indiana attorney general will be able to take action against companies in violation.
In the meantime, as Hoosiers wait for the law to take effect, the Better Business Bureau suggests making sure companies are sharing what they’re doing with your data.
“If they don’t have anything on it in itself, you may want to inquire more about it or maybe pause on giving your personal information,” said Jennifer Adamany, communication director for the BBB Serving Central Indiana.
Adamany also urges consumers to be careful about posting personal data publicly online.
“It’s doing everything you can to not only ensure that the information you’re giving to businesses are properly handled, but handling your own information,” she said.
Certain kinds of businesses are exempt from the new law, such as health care providers and banks, since their use of people’s information is already regulated by the federal government.
