Policy Briefing — August 15, 2025

Executive briefing: Indiana Senate Enrolled Act 5 (SEA 5) takes effect on January 1, 2026, creating comprehensive consumer privacy rights enforced by the Attorney General. Controllers meeting the 100,000-resident threshold—or 25,000 with at least 50 percent revenue from data sales—must honour access, correction, deletion, and portability requests within 45 days, publish clear privacy notices, and conduct data protection assessments for profiling, targeted advertising, and processing of sensitive personal data.

Key policy checkpoints

• Transparency updates. Ensure privacy notices list processing purposes, categories of data shared with third parties, and appeal mechanisms as required by SEA 5 Section 8.
• Universal opt-out. Implement mechanisms to recognise browser-based opt-out signals for targeted advertising and data sales.
• Sensitive data governance. Require consent before processing precise geolocation, biometric, or children’s data, and maintain revocation handling.

Operational priorities

• Request fulfilment. Build workflows to authenticate consumers, respond within statutory timelines, and log appeals for Attorney General review.
• Assessment backlog. Prioritise data protection assessments for AI-driven profiling or automated decision-making that could materially affect consumers.
• Vendor oversight. Amend processor contracts to include deletion assistance, sub-processor disclosures, and compliance attestations.

Enablement moves

• Train frontline teams on Indiana-specific definitions—such as “targeted advertising” and “sale” of personal data—to avoid inconsistent interpretations.
• Align Indiana readiness with neighbouring state requirements (Kentucky, Ohio) to streamline Midwest compliance operations.

Sources

• Indiana SEA 5 — Consumer data protection
• Indiana Attorney General: Consumer privacy resources
• Foley & Lardner: Indiana Consumer Data Protection Act overview

Zeph Tech compresses Indiana privacy readiness into a single dashboard, aligning policy updates, consent engineering, and request handling playbooks.

Related briefings

Curated signals from the same pillar or overlapping topics.

Policy · Credibility 40/100 · July 1, 2025

Policy Briefing — July 1, 2025

Tennessee’s Information Protection Act takes effect July 1, 2025, requiring controllers to support sale and ad opt-outs, close consumer requests within 45 days, and retain DPIA plus 60-day cure evidence for…

Policy · Credibility 40/100 · July 31, 2025

Policy Briefing — July 31, 2025

Minnesota’s Consumer Data Privacy Act becomes enforceable July 31, 2025, requiring controllers to deliver consumer rights, document DPIAs, and coordinate attorney-general engagement workflows for complaints.

Policy · Credibility 88/100 · November 3, 2020

Policy Briefing — California Privacy Rights Act Approved

Detailed implementation playbook for the California Privacy Rights Act, covering new rights, contracting duties, governance models, automated decision-making, and program management through 2023 enforcement.

Policy · Credibility 92/100 · August 14, 2020

Policy Briefing — California OAL approves final CCPA regulations effective immediately

The California Office of Administrative Law approved the Attorney General’s CCPA regulations on August 14, 2020, filing them with immediate effect and clarifying notices, request handling, and verification standards.

Policy · Credibility 91/100 · July 1, 2020

Policy Briefing — California begins CCPA enforcement on July 1, 2020

The California Department of Justice started enforcing the California Consumer Privacy Act on July 1, requiring businesses to honor access, deletion, opt-out, and notice obligations despite pending regulation approvals.

Continue in the Policy pillar

Return to the hub for curated research and deep-dive guides.

Visit pillar hub

Latest guides

• Semiconductor Industrial Strategy Policy Guide — Zeph Tech

  Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.

• Digital Markets Compliance Guide — Zeph Tech

  Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…

• Export Controls and Sanctions Policy Guide — Zeph Tech

  Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…