🇺🇸Iowa Consumer Data Protection Act

Skin

← Back to laws in United States

Iowa Consumer Data Protection Act

Iowa Consumer Data Protection Act

The Iowa Consumer Data Protection Act creates privacy obligations for covered controllers and processors that handle personal data of Iowa consumers. It follows the broader US state privacy model but has its own definitions, exemptions, consumer rights, controller duties and enforcement structure.

The Act should not be treated as a copy of California law. It is narrower in some respects and uses its own statutory language. Businesses serving Iowa residents should check whether the Act applies and then build rights, notice and processor-contract workflows around the Iowa requirements.

Consumer rights under the Iowa law

Iowa consumers may submit requests to exercise rights through the means specified by the controller. The law includes rights to confirm processing and access personal data, delete personal data provided by the consumer, obtain a copy of personal data previously provided by the consumer in a portable and readily usable format, and opt out of the sale of personal data.

Parents or legal guardians may exercise rights on behalf of known children. Controllers must authenticate requests where required and handle consumer requests through secure and reliable means.

Key Provisions

Consumer rights: access, deletion of data provided by the consumer, portability and opt-out of sale.

Privacy notice: controllers must disclose categories of personal data processed, purposes, rights mechanisms and categories of data and third parties involved in sharing.

Targeted advertising and sale disclosure: if a controller sells personal data or engages in targeted advertising, it must clearly and conspicuously disclose that activity and explain how to opt out.

Processor duties: processors must assist controllers with rights requests, security obligations and breach-related obligations where reasonably practicable.

Contracts: controller-processor contracts must set out instructions, nature and purpose of processing, type of data, duration and duties of both parties.

Privacy notice and request mechanisms

The Iowa privacy notice should explain the categories of personal data processed, the purposes of processing, how consumers may exercise rights, how appeals work where applicable, categories of personal data shared with third parties and categories of third parties with whom data is shared.

Controllers must establish secure and reliable methods for consumer requests. The method should consider how consumers normally interact with the controller and should support authentication. A controller should not require a consumer to create a new account just to exercise rights, although use of an existing account may be required where appropriate.

Processor contracts and operational support

Processors must assist controllers with consumer rights requests, security of processing and security breach-related obligations where reasonably practicable. A written contract should govern processing, confidentiality, deletion or return of data, subcontractors and information needed to demonstrate compliance.

As with other state laws, the distinction between controller and processor is practical. It should be based on who determines the purposes and means of processing, not merely on what the commercial contract calls the parties.

Practical risk area

Iowa’s law should be configured separately in a US state privacy matrix. Do not assume that rights, sensitive data rules, appeal rules and assessment duties are identical to California, Delaware, Texas or Virginia.

Exemptions and overlap with federal law

The Iowa law includes exemptions for several categories of federally regulated information and activities, including certain HIPAA, FCRA, FERPA, COPPA and other data categories. These exemptions need careful mapping because a business may hold both exempt and non-exempt data.

For example, a financial or healthcare business may have some data flows governed by federal law and other consumer, website or marketing data flows that need separate review.

What this means for you

If Iowa law applies, update your privacy notice, configure rights workflows, disclose sale and targeted advertising where relevant, review processor contracts and document which data falls inside or outside the Act because of federal-law exemptions.

Other laws in United States
CA-DELETE

California Delete Act and Data Broker Requirements

California Privacy Protection Agency

Open law Read analysis
CPPA

California Privacy Rights Act and California Privacy Protection Agency provisions

California Privacy Protection Agency

Open law Read analysis
CLOUD-ACT

Clarifying Lawful Overseas Use of Data Act (CLOUD Act)

United States Department of Justice

Open law Read analysis
42-CFR-P2

Confidentiality of Substance Use Disorder Patient Records

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
CAN-SPAM

Controlling the Assault of Non-Solicited Pornography And Marketing Act

Federal Trade Commission

Open law Read analysis
CPNI

Customer Proprietary Network Information Rules

Federal Communications Commission

Open law Read analysis
DPPA

Drivers Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis
ECPA-SCA

Electronic Communications Privacy Act and Stored Communications Act

United States Department of Justice

Open law Read analysis
FERPA

Family Educational Rights and Privacy Act

U.S. Department of Education, Student Privacy Policy Office

Open law Read analysis
GINA

Genetic Information Nondiscrimination Act

U.S. Equal Employment Opportunity Commission and federal health agencies

Open law Read analysis
HITECH

Health Information Technology for Economic and Clinical Health Act

U.S. Department of Health and Human Services, Office for Civil Rights

Open law Read analysis
HIPAA

Health Insurance Portability and Accountability Act of 1996

U.S. Department of Health and Human Services Office for Civil Rights

Open law Read analysis
IL-BIPA

Illinois Biometric Information Privacy Act

Illinois Attorney General and private enforcement

Open law Read analysis
MT-CDPA

Montana Consumer Data Privacy Act

Montana Attorney General, Office of Consumer Protection

Open law Read analysis
NJDPA

New Jersey Data Privacy Law

New Jersey Attorney General and Division of Consumer Affairs

Open law Read analysis
PRIVACY-ACT

Privacy Act of 1974

U.S. Department of Justice, Office of Privacy and Civil Liberties

Open law Read analysis
RI-DTPPA

Rhode Island Data Transparency and Privacy Protection Act

Rhode Island Attorney General

Open law Read analysis
UCPA

Utah Consumer Privacy Act

Utah Attorney General and Division of Consumer Protection

Open law Read analysis
VT-DPOSA

Vermont Data Privacy and Online Surveillance Act

Vermont Attorney General

Open law Read analysis
VPPA

Video Privacy Protection Act

United States Department of Justice and federal courts

Open law Read analysis