{"data":{"id":"us-in/ic-24-15-8-7","jurisdiction":"us-in","citation":"IC 24-15-8-7","heading":"Processing of personal data for authorized purposes; collection, use, or retention of personal data; burden of proof for exemption","body":"Sec. 7. (a) Personal data processed by a controller for a purpose authorized under this chapter may not be processed for any other purpose unless otherwise allowed under this article. Personal data processed by a controller under this chapter may be processed to the extent that such processing is:\n(1) reasonably necessary and proportionate to a purpose authorized under this chapter; and\n(2) adequate, relevant, and limited to what is necessary in relation to the specific purpose.\n(b) Personal data collected, used, or retained under section 2 of this chapter:\n(1) shall, as applicable, take into account the nature and purpose of the collection, use, or retention; and\n(2) must be subject to reasonable administrative, technical, and physical measures to:\n(A) protect the confidentiality, integrity, and accessibility of the personal data; and\n(B) reduce reasonably foreseeable risks of harm to consumers relating to such collection, use, or retention of the personal data.\n(c) If a controller processes personal data pursuant to an exemption under this chapter, the controller bears the burden of demonstrating that such processing:\n(1) qualifies for the exemption; and\n(2) complies with the requirements set forth in this section.","path":["TITLE 24. TRADE REGULATION","ARTICLE 15. CONSUMER DATA PROTECTION","Chapter 8. Limitations"],"source_url":"https://iga.in.gov/ic/2026/Title_24.html#24-15-8-7","current_through":"2026","vintage":"2026","retrieved_at":"2026-09-04T18:50:41Z","sha256":"478999ec921fd1d38fb4f4ff60da5e0b21e46332056b112376f91d6e2b7b79eb","source_id":"us-in","stale":false,"prev":"us-in/ic-24-15-8-6","next":"us-in/ic-24-15-9-1"},"notice":"GroundRules: Original legal text. Not legal advice."}