ShuttlewrightThree new state privacy laws started on 1 January 2026. Do they reach you?
Indiana, Kentucky and Rhode Island now have comprehensive consumer privacy laws. Find out in two minutes, free, whether your business is over the line. Then get the documents.
Run the free check See the pack
Free applicability check
Enter how many residents of each state you handled personal data for in the year that counts (Rhode Island: the preceding calendar year). Count people acting for personal or household reasons, not business contacts or employees. Nothing you type leaves this page.
The tests: Indiana and Kentucky, 100,000 consumers, or 25,000 and more than 50% of gross revenue from selling personal data. Rhode Island, 35,000 customers, or 10,000 and more than 20% of gross revenue from selling personal data. Nonprofits, government bodies, higher education, financial institutions under Gramm-Leach-Bliley and HIPAA covered entities are carved out by entity. This is a screen, not a legal opinion. Sources: Indiana Code 24-15, KRS 367.3613, R.I. 6-48.1-4.
What the three laws ask of a business that is in scope
- Publish a privacy notice that says what you collect, why, who gets it, and how to use and appeal your rights.
- Answer access, correction, deletion, copy and opt-out requests within 45 days (one 45-day extension with notice). Answer appeals within 60 days.
- Get consent before processing sensitive data.
- Put a written contract in place with vendors that process data for you.
- Write a data protection assessment for targeted advertising, selling data, risky profiling and sensitive data.
- Indiana and Kentucky: the attorney general must give 30 days to cure. Rhode Island's text has no cure period, and Rhode Island is the only one of the three with a 35,000 threshold, which is the lowest.
Rhode Island section 6-48.1-3 also asks commercial websites with Rhode Island customers to name a controller and post what they collect, who they sell to, and a contact address. The text is not tied to the size thresholds, so check how it applies to you.
The Starter Pack
- Applicability worksheet with the counts, carve-outs and a decision record.
- Privacy notice template with the items all three states expect.
- Consumer request procedure: the clocks, the steps, and six letters (acknowledge, verify, extend, complete, decline with appeal rights, appeal outcome).
- Processor contract clauses for vendors.
- Data protection assessment template.
- Attorney general notice and cure playbook, with a draft cure statement.
- Three-state quick card, and an Excel records workbook: threshold count, data inventory, request log with due dates, processor register, assessments, review calendar.
What it is not: a set of templates, not legal advice, and not a promise that you comply. It does not cover other states, cookie tools or sector rules. Have a lawyer in your state review what you rely on. Statutes checked against the official state sources on 18 October 2026.
One-off. Instant download after payment. Eight Word files and one Excel workbook.
Buy the pack - $39Checkout by Polar, in US dollars. If the files do not arrive, email fuseini.metadata@gmail.com with your receipt.
Questions
I am a small shop. Does this apply to me? Often not. Indiana and Kentucky start at 100,000 residents. Rhode Island starts at 35,000 customers. The free check tells you where you stand. If you are well under, the pack still gives you a notice, a request procedure and a record that you checked.
Why these three states? They are the comprehensive privacy laws that came into force on 1 January 2026.
Will this make me compliant? No document can promise that. The pack helps you do the steps the statutes describe and keep a record. You still have to do them and keep them up to date.
Is a $39 pack a better deal than a generator? A policy generator writes a policy, and monthly plans start around $10 a month (Termly's starter plan). This pack covers the rest of the three laws: counting, requests, vendor terms, assessments and the attorney general process, in one payment.