Indiana Consumer Data Protection Act 24-15-8-7: IC 24-15-8-7 Processing under an exemption must be necessary, proportionate, limited and secured

Data processed under a chapter 8 purpose may not be processed for other purposes unless the article allows it, and only to the extent reasonably necessary and proportionate and adequate, relevant and limited to the specific purpose; data kept for internal research, recalls, error repair or internal operations must reflect the nature and purpose of that use and be protected by reasonable measures that secure it and reduce foreseeable harm; a controller relying on an exemption bears the burden of showing it qualifies and meets these conditions.