Iowa. Breach notification. Act
IA breach lawIowa data breach notification law (Iowa Code ch. 715C)
Partly verified
Medium confidence.Penalty figure from Iowa Consumer Fraud Act general cap; not confirmed on summary page.
§1Summary
- Synopsis
Requires businesses (and in most cases public bodies) that own or license computerised personal information about Iowa residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expeditious manner possible. Covered data: name plus SSN, government ID, financial account with codes, unique electronic identifier/routing code, biometric data.
- Key themes
- Unique features
Short 5-business-day AG window after consumer notice; no-harm determinations must be documented and kept for 5 years.
- SaaS relevance
A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Iowa requires the maintaining entity to notify the owner immediately after discovery. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.
§2Obligations
- Extraterritorial
- Limited
- Breach notification
- Individuals in the most expeditious manner possible; AG within 5 business days after notifying consumers if >500 residents
- DPO
- No
- Cross-border transfers
- None
- Maximum penalty
- Consumer Fraud Act remedies; up to $40,000 per violation
§3Dates
- Key dates
- Adopted
- In force
- SF 2177 (2018, eff. 2018-07-01) latest amendment; SF 2259 (2014) added AG notice
§4Text and authority
- Text
- Authoritative text legis.iowa.gov
- Authority
- Iowa Attorney General (Consumer Protection Division)
§5Where it applies
- Domestic law of
- Iowa
§6Sources and verification
- Sources consulted
- Verification
Medium confidence.
Partly verified
Medium confidence.Penalty figure from Iowa Consumer Fraud Act general cap; not confirmed on summary page.