Law / United States / 
Indiana
Indiana Consumer Data Protection Act, de-identified data
Ind. Code §§ 24-15-2-12, 24-15-7-1, 24-15-7-3
In force since .
A de-identification rule binding private bodies.
- Obligation class
- Disclosure, Contract terms
- Audit expectation
- none
What it requires
- To treat data as de-identified under INCDPA, take reasonable measures to ensure that the data cannot be associated with an individual (Ind. Code 24-15-7-1(a)(1)).
- Publicly commit to maintaining and using the de-identified data without attempting to re-identify it (Ind. Code 24-15-7-1(a)(2)).
- Contractually obligate every recipient of the de-identified data to comply with all provisions of chapter 7 (Ind. Code 24-15-7-1(a)(3)).
- When disclosing pseudonymous or de-identified data, exercise reasonable oversight to monitor compliance with the contractual commitments the data is subject to, and take appropriate steps to address any breach of them (Ind. Code 24-15-7-3).
These lines are LexLint's reading of the law's text.
What it makes you log
Logging duty
Sections 24-15-2-12, 24-15-7-1 and 24-15-7-3 set conditions for treating data as de-identified, a public commitment, contract terms for recipients and oversight of recipients. None of them requires a log or record of processing, sets a retention period or gives a regulator a right to a record.
- Kind
- None
- As of
What this law does
Section 24-15-2-12 defines de-identified data as data that cannot reasonably be linked to an identified or identifiable individual because the controller that possesses it takes reasonable measures to ensure the data cannot be associated with an individual, publicly commits to maintaining and using it without attempting to re-identify it, and obligates any recipients through contractual requirements to comply with all applicable provisions of the article.
Under section 24-15-7-1(a), a controller in possession of de-identified data must take reasonable measures to ensure that the data cannot be associated with an individual, publicly commit to maintaining and using it without attempting to re-identify it, and contractually obligate any recipients to comply with all provisions of chapter 7.
Section 24-15-7-1(b) provides that chapter 7 does not require a controller or processor to re-identify de-identified data or pseudonymous data, to maintain data in identifiable form, or to collect, obtain, retain or access any data or technology in order to be capable of associating an authenticated consumer request with personal data.
Under section 24-15-7-3, a controller that discloses pseudonymous data or de-identified data must exercise reasonable oversight to monitor compliance with any contractual commitments to which the data is subject and must take appropriate steps to address any breaches of those commitments. Section 24-15-2-19(b)(1) provides that the term personal data does not include de-identified data.
When LexLint raises it
When your app profile says your app processes personal data or processes de-identified data.
Back to the example · Lint your app
Page updated .