Iowa. Comprehensive data protection. Act

Iowa CDPAIowa Act Relating to Consumer Data Protection (Iowa Code ch. 715D)

In force

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.

§1Summary

Synopsis

A narrow comprehensive law granting access, deletion, portability and opt-out of sale, with notice and opt-out for sensitive data. No data protection assessments.

Key themes

access
deletion
portability
opt-out of sale
sensitive data notice

Unique features

No right to correct and no explicit targeted-advertising opt-out; long 90-day cure period that does not sunset.

SaaS relevance

Applies at 100,000 Iowa consumers, or 25,000 with over 50% revenue from data sales.

§2Obligations

Extraterritorial: Yes
Breach notification: See Iowa Code ch. 715C (separate statute)
DPO: No
Cross-border transfers: None
Maximum penalty: $7,500 per violation

§3Dates

Key dates

Adopted 28 March 2023
In force 1 January 2025

§4Text and authority

Text

Authoritative text legis.iowa.gov

Authority

Iowa Attorney General

§5Where it applies

Domestic law of: Iowa

§6Sources and verification

Sources consulted

legis.iowa.gov

Verification

Medium confidence.

Partly verified

Medium confidence. Not re-verified against a primary source in this session (search budget exhausted); details from established knowledge.