Indiana SaaS Agreement Review
Indiana's Consumer Data Protection Act, Indiana Code 24-15, took effect January 1, 2026, which makes it one of the newest state privacy laws a software buyer has to account for. It follows the Virginia model, including processor contract requirements and a cure period. An Indianapolis or Fort Wayne business that meets the thresholds should check that its SaaS vendors have updated their data processing terms to name Indiana.
Consumer privacy law in Indiana
Indiana Consumer Data Protection Act
In force since January 1, 2026. Applies at 100,000 consumers, or 25,000 consumers where more than 50% of revenue comes from selling personal data.
Data rights in Indiana
Indiana has enacted the Indiana Consumer Data Protection Act, a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Indiana residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
Who is covered by Indiana's new privacy law?
The Act applies to businesses that control or process data of at least 100,000 Indiana consumers a year, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Like the Virginia model it copies, it requires a contract between controller and processor covering instructions, confidentiality, deletion or return of data, compliance information and subcontractor flow down.
Enforcement belongs to the Attorney General, with a 30 day opportunity to cure before an action and no private right of action.
Indiana's 45-day breach deadline
IC 24-4.9 requires notice to affected residents without unreasonable delay and no more than 45 days after discovering the breach, and anyone notifying residents must also notify the Attorney General. Credit bureaus are added above 1,000 people. A knowing or intentional failure to notify can draw a civil penalty of up to $150,000 per violation. Make sure the vendor's reporting window leaves you most of those 45 days.
Indiana's encryption and federal exemptions
Losing an encrypted portable device is not a breach if the key was not compromised and is not held by the person who took it. Businesses that follow data security procedures under federal regimes such as the Gramm-Leach-Bliley Act, HIPAA or the Fair Credit Reporting Act may be exempt. Only the Attorney General can enforce the breach law.
Indiana sources checked 2026-10-09: Ashurst Perkins Coie, Indiana breach chart. Laws change; confirm the current rule before relying on it.
Indiana SaaS agreement FAQ
Does Indiana have a data privacy law that affects SaaS contracts?
Yes. Indiana has enacted a comprehensive consumer privacy law, the Indiana Consumer Data Protection Act. It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Indiana residents. Note the scope: In force since January 1, 2026. Applies at 100,000 consumers, or 25,000 consumers where more than 50% of revenue comes from selling personal data.
Can a SaaS vendor use my Indiana business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Indiana law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Indiana?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Indiana law in about a minute.
Does Indiana's breach law require AG notice for small breaches?
Yes. Indiana ties Attorney General notice to resident notice rather than to a minimum number of people, so any breach that requires notifying Indiana residents also requires notifying the Attorney General. Your SaaS contract should require the vendor to supply the facts you need for that filing quickly.
Do existing SaaS contracts need updating for Indiana's 2026 law?
If your business meets the thresholds, yes. Contracts signed before January 1, 2026 may not include the processor terms the Act requires. Many vendors publish a multi-state data processing addendum; check that it now lists Indiana, or ask for an amendment.
Reviewing a SaaS contract in Indiana?
Upload it and get the data, liability, and renewal terms checked against Indiana law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Indiana law when you run your agreement, and you should confirm anything critical with a qualified attorney.