Are mandatory arbitration provisions recognized in your state? If so, are there any limitations to its enforcement?

In short, yes. A party seeking to compel arbitration must: (1) demonstrate the existence of an enforceable agreement to arbitrate the dispute; and (2) prove that the disputed matter is the type of claim that the parties agreed to arbitrate.[i] Once the court is satisfied that the parties contracted to submit their dispute to arbitration, the court is required to compel arbitration.[ii]

There are some limits regarding whether a party is compelled to participate in arbitration.  Specifically, while the parties are bound to arbitrate all matters, not explicitly excluded that reasonably fit within the language used in an arbitration agreement, they are only bound to arbitrate those issues that by clear language they have agreed to arbitrate.[iii]

Arbitration agreements can also be attacked as being unconscionable or as having resulted from fraud or unequal bargaining power.[iv]

What is your state’s law, if any, regarding gift cards, subscription services and loyalty programs?

There is limited case law and/or statutory laws governing gift cards, subscription services, and loyalty programs.  However, House Bill 1181 does provide certain restrictions on gift cards.

Specifically, according to state legislature, House Bill 1181 provides in part that if after any time a gift card sold or issued to an Indiana consumer and the merchant/business: (1) ceases to do business within Indiana; (2) ceases to offer the types of goods or services that were offered to consumers at the time the gift card was originally offered and/or sold, if the expiration date has not already elapsed, the merchant or business owner, upon request by the consumer, shall promptly refund to the holder of the gift certificate the balance of the underlying funds or provide the consumer the remaining balance in some other manner.

The house bill expressly provides that violation of House Bill 1181 would be actionable under the Deceptive Consumer Act, and the consumer would be entitled to remedies codified under the Act.

What is your state’s law, if any, regarding safeguarding consumer credit card or other private data (i.e., cyber security)?

Signed into law on May 1, 2024 and effective on January 1, 2026, the Indiana Consumer Data Protection Act outlines the rights of consumers regarding their data privacy, as well as the obligations of controllers to protect their consumers’ data.[1] The Act covers one (a) who conducts business in Indiana or (b) produces products/services which are targeted towards residents of Indiana and (1) controls or processes personal data of at least 100,000 Indiana residents or (2) controls or processes personal data of at least 25,000 Indiana residents and derives over 50 percent of its gross revenue from the sale of personal data. The Act outlines the obligations of controllers, including the following:

• Limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to disclosed purposes for which such data is processed.
• Adopt and implement reasonable administrative, technical, and physical data security practices.
• Process consumers’ sensitive data only after obtaining the consumer’s consent.
• Process consumer data in a non-discriminatory manner and refrain from discriminating against consumers who exercise the rights granted by the statute.
• Provide a clear privacy policy that includes the categories of personal data processed, the purpose for processing personal data, the categories of data shared with third parties, the types of third parties, the consumer’s rights, and how consumers may exercise their rights, including an appeal.
• Clearly disclose if the controller sells consumers’ personal data to third parties or engages in targeted advertising and provide consumers an opportunity to opt out.
• Establish a process for consumers to appeal the refusal to take action on requests to exercise their rights.
• Conduct a data protection impact assessment on the processing of personal data for targeted advertising, the sale of personal data, profiling, sensitive data, and any processing activities that involve personal data that present a heightened risk of harm to consumers.
• When in possession of deidentified data, take reasonable measures to ensure that the data cannot be associated with an individual, commit publicly to maintaining data as deidentified data, and obligate any recipients of the data to comply with the Indiana Data Privacy Law.[2]

Additionally, the Act grants consumers the following rights:

• Confirm with the controller whether the controller is processing the consumer’s data.
• Correct inaccuracies in the consumer’s personal data that the consumer provided to the controller.
• Delete personal data provided by or obtained about the consumer.
• Obtain a copy of or a representative summary of the consumer’s personal data that the consumer previously provided to the controller (i.e., data portability).
• Opt out of the processing of the consumer’s personal data for purposes of targeted advertising, the sale of personal data, or profiling.[3]

What is your state’s law, if any, regarding the collection and handling of financial information?

The Indiana Consumer Protection Act also protects the collection and handling of consumers’ financial information and data.[4] However, financial institutions themselves are expressly exempt from this Act.[5]

Additionally, IC 4-1-11-5 provides that any state agency that owns or licenses computerized data that includes personal information, including financial information, shall disclose a breach of the security of the system following discovery or notification of the breach to any state resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person.[6]

[1] See S.E.A. 5, 123rd Gen/ Assemb., Reg. Sess. (Ind. 2023).

[2] See id,

[3] See id.

[4] See id.

[5] See id.

[6] See Ind. Code § 4-1-11-5 (2023).

[i] See, Safety Nat. Cas. Co. v. Cinergy Corp., 829 N.E.2d 986 (Ind. Ct. App. 2005)

[ii] Id.  See also, Ind. Code § 34-57-2-3

[iii] Id

[iv] See, Walker v. DaimlerChrysler Corp., 856 N.E. 2d 90 (Ind. Ct. App. 2006)