§ 24-15-2-27 — "Sale of personal data"

Effective 1-1-2026.
Sec. 27. (a) "Sale of personal data" means the
exchange of personal data for monetary consideration by a controller
to a third party.
(b) The term does not include:
(1) the disclosure of personal data to a processor that processes
the personal data on behalf of the controller;
(2) the disclosure of personal data to a third party for purposes of
providing a product or service requested by:
(A) the consumer; or
(B) the parent of a child;
to whom the personal data pertains;
(3) the disclosure or transfer of personal data to an affiliate of the
controller;
(4) the disclosure of information that the consumer:
(A) intentionally made available to the general public via a
channel of mass media; and
(B) did not restrict to a specific audience; or
(5) the disclosure or transfer of personal data to a third party as an
asset that is part of a proposed or actual merger, acquisition,
bankruptcy, or other transaction in which the third party assumes
control of all or part of the controller's assets.

Legislative History

As added by P.L.94-2023, SEC.1.