Law / United States / 
Iowa
Personal Information Security Breach Protection
In force.
A breach notification rule binding public and private bodies.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Audit expectation
- none
What it requires
- Notify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay.
- Notify the Iowa Attorney General's consumer protection division within five business days of notifying consumers, if the breach requires notifying more than 500 Iowa residents.
These lines are LexLint's reading of the law's text. Also read by: Iowa Attorney General's Office, Consumer Protection Division (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CM.AW-P7Impacted individuals and organizations are notified about a privacy breach or event.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications
- Guidance body
- Iowa Attorney General's Office, Consumer Protection Division
- Open questions
- Is the five-hundred-resident threshold in Iowa Code § 715C.2(8) measured by the residents whose personal information was acquired, or only by those who must be notified after a no-harm determination under § 715C.2(6)?
- Which breach rules or guidance of a person's primary or functional federal regulator provide "greater protection" and "at least as thorough disclosure requirements" for the exemption in § 715C.2(7)(a)?
What it makes you log
Log retention
Subsection 6: the documentation of the no-harm determination is maintained for five years.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 5
Logging duty
Subsection 6 excuses notice when, after an appropriate investigation or consultation with law enforcement, the person determined that no reasonable likelihood of financial harm has resulted or will result, and requires that determination to be documented in writing with the documentation maintained for five years. The subsection names no field of the record from the closed list and does not say that the Attorney General may demand it, so no contents or access are taken. Notice of a breach to consumers (subsections 1 to 5) and the written notice to the consumer protection division of the Attorney General for a breach reaching more than 500 residents (subsection 8) are notices, not a kept record. The consumer is defined in section 715C.1(2) as an individual who is a resident of the state.
- Kind
- Explicit
- As of
- Provision
- Iowa Code 715C.2(6)
- Trigger
- security_incident
What this law does
Notification of a breach of security must be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. A business subject to a breach requiring notification to more than 500 Iowa residents must also give written notice to the director of the consumer protection division of the Attorney General's office within five business days of notifying consumers.
A violation is an unlawful practice under section 714.16, and the Attorney General may recover damages on behalf of an injured person, but that recovery runs through the Attorney General rather than arming the person with a direct private right of action. The provisions this entry describes came into force on different days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .