Does Indiana's Data Privacy Law Apply to a Trainer?

Indiana’s Consumer Data Protection Act is a real state law, but it is written around businesses that handle personal data at a meaningful scale, and a solo trainer running a client book out of one private room at FlexWerk in Carmel sits far below the volume the law was built to reach. That does not mean the question is irrelevant, only that the honest answer starts with what kind of data a training business actually collects, not with the headline of the law.

What the rule says

Indiana’s Consumer Data Protection Act, checked against the statute in September 2026, sets obligations for businesses that control or process Indiana residents’ personal data at a defined annual volume, or that derive a meaningful share of revenue from selling that data. The specific numeric thresholds are a detail worth confirming directly with an attorney or the current statute rather than assuming, since state privacy laws set exact figures that can change as they are amended. This is general information, not legal advice, and the safest move for any business unsure of its status is direct confirmation rather than a guess.

What data a training business actually holds

A trainer’s records are ordinary, not exotic: names, phone numbers, emails, payment details run through a processor, and intake or InBody information a client volunteers. That is meaningfully different from the kind of business the law is aimed at, one that aggregates, analyzes, or sells personal data about large numbers of people as part of the business model itself. Holding contact and health-history information about a client roster of dozens or a few hundred people is not the same activity. That is also why confusion with HIPAA rules in a gym-based practice is common, the health-adjacent intake data feels sensitive even when the business itself sits outside the laws built for hospitals and insurers.

Why scale, not the type of data, decides the question

State privacy laws built like Indiana’s generally use a volume threshold precisely so small, local service businesses are not swept in alongside data brokers and large platforms. A trainer whose entire client list would not fill a single afternoon at a mid-size company’s customer database is the kind of business these thresholds are written to leave outside the law’s reach in practice, even though the exact cutoff numbers are not something to state casually rather than confirm.

What to do instead of guessing

Two moves cover a solo trainer honestly: keep ordinary good data hygiene anyway, a locked intake form, a real payment processor rather than a personal payments app, and passwords instead of a shared notebook, and ask a business attorney a direct yes-or-no question about your specific client volume if the answer matters to you, rather than relying on a blog post, including this one, for the final word. If privacy of your own home address is the real worry behind the question, look at your registered agent setup instead, since that is the more common actual risk for a home-based trainer, and it is a much easier one to fix.

A five-minute question to an attorney settles this permanently. Guessing does not.