Ind. Code ch. 24-15-8

in effect

Ind. Code § 24-15-8-1 Permissible activities by controllers and processors

Sec. 1. (a) This article shall not be construed to restrict a controller's or processor's ability to do any of the following: (1) Comply with federal, state, or local laws, rules, or regulations or, in the case of an owner of a riverboat licensed under IC 4-33-6, implement and operate a facial recognition program approved by the Indiana gaming commission. (2) Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental authority. (3) Cooperate with law enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations. (4) Investigate, establish, exercise, prepare for, or defend legal claims. (5) Provide a product or service specifically requested by a consumer, perform a contract to which the consumer, or a parent of a child, is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer or parent before entering into a contract. (6) Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or of another individual, if the processing cannot be manifestly based on another legal basis. (7) Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, investigate, report, or prosecute those responsible for any such action, and preserve the integrity or security of systems. (8) Engage in public or peer reviewed scientific or statistical research that is in the public interest and that adheres to all applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, or a similar independent oversight entity, that determines if: (A) the information is likely to provide substantial benefits that do not exclusively accrue to the controller; (B) the expected benefits of the research outweigh the privacy risks; and (C) the controller has implemented reasonable safeguards to mitigate privacy risks associated with research, including any risks associated with re-identification. (9) Assist another controller, processor, or third party with any obligation described in this section. (b) Processing personal data for a purpose expressly identified in subsection (a)(1) through (a)(9) does not by itself make a person a controller with respect to such processing. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-2 Collecting, using, or retaining data; permissible purposes

Sec. 2. The obligations imposed on a controller or a processor under this article do not prohibit or restrict a controller or processor from collecting, using, or retaining data to do the following: (1) Conduct internal research to develop, improve, or repair products, services, or technology. (2) Effectuate a product recall. (3) Identify and repair technical errors that impair existing or intended functionality. (4) Perform internal operations that are: (A) reasonably compatible with the expectations of the consumer; (B) reasonably anticipated based on the consumer's existing relationship with the controller; or (C) otherwise compatible with: (i) processing data in furtherance of the provision of a product or service specifically requested by a consumer, or the parent of a child; or (ii) the performance of a contract to which the consumer is a party. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-3 Evidentiary privilege; exemption from obligations concerning personal data

Sec. 3. The obligations imposed on a controller or a processor under this article do not apply if compliance by the controller or processor with this article would violate an evidentiary privilege under Indiana law. This article shall not be construed to prohibit a controller or processor from providing, as part of a privileged communication, personal data concerning a consumer to a person covered by an evidentiary privilege under Indiana law. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-4 Disclosure of personal data to third party controller or processor

Sec. 4. A controller or processor that discloses personal data to a third party controller or processor in compliance with this article is not in violation of this article if the third party controller or processor that receives and processes the personal data violates this article, as long as, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation. A third party controller or processor receiving personal data from a controller or processor is likewise not in violation of this article solely because of the transgressions of the controller or processor from which it receives such personal data. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-5 Personal rights or freedoms; free speech; personal data in context of purely personal or household activity

Sec. 5. This article: (1) shall not be construed as an obligation imposed on controllers and processors that adversely affects the rights or freedoms of any persons, such as exercising the right of free speech under the First Amendment to the Constitution of the United States; and (2) does not apply to personal data in the context of a purely personal or household activity. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-6 Controller not required to disclose trade secrets

Sec. 6. Nothing in this article shall be construed as requiring a controller to disclose trade secrets. As added by P.L.94-2023, SEC.1.

Ind. Code § 24-15-8-7 Processing of personal data for authorized purposes; collection, use, or retention of personal data; burden of proof for exemption

Sec. 7. (a) Personal data processed by a controller for a purpose authorized under this chapter may not be processed for any other purpose unless otherwise allowed under this article. Personal data processed by a controller under this chapter may be processed to the extent that such processing is: (1) reasonably necessary and proportionate to a purpose authorized under this chapter; and (2) adequate, relevant, and limited to what is necessary in relation to the specific purpose. (b) Personal data collected, used, or retained under section 2 of this chapter: (1) shall, as applicable, take into account the nature and purpose of the collection, use, or retention; and (2) must be subject to reasonable administrative, technical, and physical measures to: (A) protect the confidentiality, integrity, and accessibility of the personal data; and (B) reduce reasonably foreseeable risks of harm to consumers relating to such collection, use, or retention of the personal data. (c) If a controller processes personal data pursuant to an exemption under this chapter, the controller bears the burden of demonstrating that such processing: (1) qualifies for the exemption; and (2) complies with the requirements set forth in this section. As added by P.L.94-2023, SEC.1.

Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://iga.in.gov/laws/2026/ic/titles/24Fetched: 10/17/2026