Sec. 1. (a) This article applies to a person that conducts business in Indiana or produces products or services that are targeted to residents of Indiana and that during a calendar year:

(1) controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents; or

(2) controls or processes personal data of at least twenty-five thousand (25,000) consumers who are Indiana residents and derives more than fifty percent (50%) of gross revenue from the sale of personal data.

     (b) This article does not apply to any of the following:

(1) Either of the following:

(A) The state, a state agency, or a body, authority, board, bureau, commission, district, or agency of any political subdivision of the state.

(B) A third party under contract with an entity described in clause (A), when acting on behalf of the entity. This clause does not exempt data held or created by third parties outside of the scope of the contract with the entity.

(2) Any financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.).

(3) Any covered entity or business associate governed by the privacy, security, and breach notification rules issued by the United States Department of Health and Human Services (45 CFR Parts 160 and 164) pursuant to HIPAA.

(4) Any nonprofit organization.

(5) Any institution of higher education.

(6) Any public utility (as defined in IC 8-1-2-1(a)) or service company affiliated with a public utility (as defined in IC 8-1-2-1(a)). For purposes of this subdivision, “service company” means an associate company within a holding company system organized specifically for the purpose of providing goods or services to a public utility (as defined in IC 8-1-2-1(a)) in the same holding company system.

As added by P.L.94-2023, SEC.1.