Ind. Code § 24-15-2-0.5 Applicability of definitions
Sec. 0.5. The definitions in this chapter apply throughout this article.
As added by P.L.94-2023, SEC.1.
Ind. Code ch. 24-15-2
Ind. Code ch. 24-15-2
in effectInd. Code § 24-15-2-1 "Affiliate"
Sec. 1. (a) "Affiliate" means a legal entity that:
(1) controls, is controlled by, or is under common control with another legal entity; or
(2) shares common branding with another legal entity.
(b) For purposes of this section, "control", with respect to a company, means:
(1) ownership of, or the power to vote, more than fifty percent (50%) of the outstanding shares of any class of voting security of the company;
(2) control in any manner over the election of a majority of the directors or of individuals exercising similar functions; or
(3) the power to exercise controlling influence over the management of the company.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-2 "Aggregate data"
Sec. 2. "Aggregate data" means information:
(1) that relates to a group or category of consumers;
(2) from which individual consumer identities have been removed; and
(3) that is not linked or reasonably linkable to any consumer.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-3 "Authenticate"
Sec. 3. "Authenticate" means to verify through reasonable means that a consumer who is entitled to exercise the personal data rights provided by IC 24-15-3 is the same consumer exercising such rights with respect to particular personal data.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-4 "Biometric data"
Sec. 4. (a) "Biometric data" means data that:
(1) is generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, images of the retina or iris, or other unique biological patterns or characteristics; and
(2) is used to identify a specific individual.
(b) The term does not include:
(1) a physical or digital photograph, or data generated from a physical or digital photograph;
(2) a video or audio recording, or data generated from a video or audio recording; or
(3) information collected, used, or stored for health care treatment, payment, or operations under HIPAA.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-5 "Business associate"
Sec. 5. "Business associate" has the meaning set forth in 45 CFR 160.103.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-6 "Child"
Sec. 6. "Child" means any individual who is less than thirteen (13) years of age.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-7 "Consent"
Sec. 7. (a) "Consent" means a clear affirmative act that signifies a consumer's freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.
(b) For purposes of this section, a "clear affirmative act" includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-8 "Consumer"
Sec. 8. (a) "Consumer" means an individual who:
(1) is a resident of Indiana; and
(2) is acting only for a personal, family, or household purpose.
(b) The term does not include an individual acting in a commercial or employment context.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-9 "Controller"
Sec. 9. "Controller" means a person that, alone or jointly with others, determines the purpose and means of processing personal data.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-10 "Covered entity"
Sec. 10. "Covered entity" has the meaning set forth in 45 CFR 160.103.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-11 "Decision that produces legal or similarly significant effects concerning a consumer"
Sec. 11. "Decision that produces legal or similarly significant effects concerning a consumer" means a decision made by a controller that results in the provision or denial by the controller of:
(1) financial and lending services;
(2) housing;
(3) insurance;
(4) education enrollment;
(5) criminal justice;
(6) employment opportunities;
(7) health care services; or
(8) access to basic necessities, such as food and water.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-12 "De-identified data"
Sec. 12. "De-identified data" means data that cannot reasonably be linked to an identified or identifiable individual because a controller that possesses the data:
(1) takes reasonable measures to ensure that the data cannot be associated with an individual;
(2) publicly commits to maintaining and using the data without attempting to re-identify the data; and
(3) obligates any recipients of the data through contractual requirements to comply with all applicable provisions of this article.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-13 "Health care provider"
Sec. 13. "Health care provider" has the meaning set forth in IC 4-6-14-2.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-14 "Health record"
Sec. 14. "Health record" has the meaning set forth in IC 1-1-4-5(a)(6).
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-15 "HIPAA"
Sec. 15. "HIPAA" refers to the federal Health Insurance Portability and Accountability Act of 1996 (42 U.S.C. 1320d et seq.).
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-16 "Identified or identifiable individual"
Sec. 16. "Identified or identifiable individual" means an individual who can be readily identified, directly or indirectly.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-17 "Institution of higher education"
Sec. 17. "Institution of higher education" means a public or private college or university.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-18 "Nonprofit organization"
Sec. 18. "Nonprofit organization" means any organization exempt from taxation under Section 501(c)(3), 501(c)(6), or 501(c)(12) of the Internal Revenue Code.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-19 "Personal data"
Sec. 19. (a) "Personal data" means information that is linked or reasonably linkable to an identified or identifiable individual.
(b) The term does not include:
(1) de-identified data;
(2) aggregate data; or
(3) publicly available information.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-20 "Precise geolocation data"
Sec. 20. (a) "Precise geolocation data" means information derived from technology, including global positioning system level latitude and longitude coordinates, that directly identifies the specific location of a natural person with precision and accuracy within a radius of one thousand seven hundred fifty (1,750) feet.
(b) The term does not include:
(1) the content of communications; or
(2) any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-21 "Processing"
Sec. 21. "Processing", with respect to personal data, means any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-22 "Processor"
Sec. 22. "Processor" means a person that processes personal data on behalf of a controller.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-23 "Profiling"
Sec. 23. "Profiling" means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual's economic situation, health or health records, personal preferences, interests, reliability, behavior, location, or movements.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-24 "Protected health information"
Sec. 24. "Protected health information" has the meaning set forth in 45 CFR 160.103.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-25 "Pseudonymous data"
Sec. 25. "Pseudonymous data" means personal data that cannot be attributed to a specific individual because additional information that would allow the data to be attributed to a specific individual is:
(1) kept separately; and
(2) subject to appropriate technical and organizational measures;
to ensure that the personal data is not attributed to an identified or identifiable individual.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-26 "Publicly available information"
Sec. 26. "Publicly available information" means information:
(1) that is lawfully made available through federal, state, or local government records; or
(2) that a business has a reasonable basis to believe is lawfully made available:
(A) to the general public through widely distributed media;
(B) by the consumer to whom the information pertains; or
(C) by a person to whom the consumer has disclosed the information;
unless the consumer has restricted the information to a specific audience.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-27 "Sale of personal data"
Sec. 27. (a) "Sale of personal data" means the exchange of personal data for monetary consideration by a controller to a third party.
(b) The term does not include:
(1) the disclosure of personal data to a processor that processes the personal data on behalf of the controller;
(2) the disclosure of personal data to a third party for purposes of providing a product or service requested by:
(A) the consumer; or
(B) the parent of a child;
to whom the personal data pertains;
(3) the disclosure or transfer of personal data to an affiliate of the controller;
(4) the disclosure of information that the consumer:
(A) intentionally made available to the general public via a channel of mass media; and
(B) did not restrict to a specific audience; or
(5) the disclosure or transfer of personal data to a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller's assets.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-28 "Sensitive data"
Sec. 28. "Sensitive data" means a category of personal data that includes any of the following:
(1) Personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a health care provider, sexual orientation, or citizenship or immigration status.
(2) Genetic or biometric data that is processed for the purpose of uniquely identifying a specific individual.
(3) Personal data collected from a known child.
(4) Precise geolocation data.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-29 "State agency"
Sec. 29. "State agency" has the meaning set forth in IC 1-1-15-3.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-30 "Targeted advertising"
Sec. 30. (a) "Targeted advertising" means the displaying of an advertisement to a consumer in which the advertisement is selected based on personal data obtained from that consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests.
(b) The term does not include:
(1) advertisements based on activities within a controller's own or affiliated websites or online applications;
(2) advertisements based on the context of a consumer's current search query, visit to a website, or online application;
(3) advertisements directed to a consumer in response to the consumer's request for information or feedback; or
(4) the processing of personal data solely for measuring or reporting advertising performance, reach, or frequency.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-31 "Third party"
Sec. 31. "Third party", with respect to a context to which this article applies, means a natural or legal person, public authority, agency, or body other than:
(1) the consumer;
(2) the controller;
(3) the processor; or
(4) an affiliate of the processor or the controller.
As added by P.L.94-2023, SEC.1.
Ind. Code § 24-15-2-32 "Trade secret"
Sec. 32. "Trade secret" has the meaning set forth in IC 24-2-3-2.
As added by P.L.94-2023, SEC.1.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/24Fetched: 10/17/2026