What Is the Indiana Consumer Privacy Bill (SB 358)?

Privacy legislation is making waves in a big way this year in the US, with more than 30 states considering bills that could soon be signed into law. This legislative session, Indiana has an active consumer privacy bill in consideration by the state’s House. Here’s a look into the status of Indiana Consumer Privacy Bill SB 358.

Although Indiana introduced two consumer privacy bills this year, only one of them is still active. SB 358 was introduced, read, and referred to the Senate Committee on Commerce and Technology on January 10, 2022. Following an earlier hearing, the bill was read a third time and passed by the Senate on February 1.

From the Senate, the bill moved to the House Commerce, Small Business, and Economic Development Committee, which passed it on February 17. Second and third readings of the bill were procedurally required before it could be passed, but the House Committee missed the deadlines.

As it stands, no further movement has occurred on the bill. The deadline for both houses of the Indiana legislature to adjourn for this session is March 14, 2022.

Indiana Consumer Privacy Bill and Virginia’s CDPA

The latest version of Indiana’s SB 358 mirrors the Utah Consumer Privacy Act (UCPA) and Virginia Consumer Data Protection Act (VCDPA) in terms of application, exemptions, and consumer rights.

SB 358 applies to a person that conducts business or produces products and/or services that target Indiana residents and that:

  • processes or controls the personal data of at least 100,000 consumers within a calendar year; or
  • controls or processes the personal data of at least 25,000 consumers and derives more than 50% of its gross revenue from the sale of personal data.

SB 358 also does not provide a private right of action for consumers, granting Indiana’s Attorney General full enforcement powers.

Should the House fail to pass SB 358 before Indiana’s current legislative session ends, the bill will either carry over to the next session or will need to be reintroduced as a new bill.

Indiana SB 358 Exemptions

Also like the VCDPA, SB 358 contains specific exemptions for certain types of businesses, as well as businesses regulated by federal laws already on the books. These exemptions include:

SB 358 Consumer Rights — and How to Prepare

The Indiana bill also provides for a number of consumer rights, such as the right to access, correct, or delete personal data. Additionally, the bill allows a business a right to cure within 30 days. If passed, Indiana’s bill would take effect on January 1, 2025.

To get ahead of privacy bills that might soon become law, privacy professionals need to implement ML-based technology that automates data subject rights like the right to access and correct.

With BigID’s deep discovery foundation that covers all of an organization’s data — everywhere across the organization — businesses can meet compliance with Indiana’s Consumer Privacy Bill 358, and every state currently considering enacting a comprehensive privacy law.

Schedule a demo to learn more about how BigID can help your business.