Law / United States / 
Iowa
Iowa Consumer Data Protection Act, consumer rights
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Give an Iowa consumer a means to confirm whether you process their personal data, access it, delete it, and receive a portable copy. ICDPA does not require you to offer a correction mechanism.NIST Privacy FrameworkCT.PO-P3
- Offer an Iowa consumer an opt-out of the sale of personal data. If you sell personal data to third parties or engage in targeted advertising, disclose that clearly and conspicuously together with the manner in which a consumer may opt out of it. ICDPA gives no right to opt out of profiling.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkCM.AW-P1
- Respond to a consumer rights request without undue delay and within 90 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does the deletion right in Iowa Code § 715D.3(1)(b) reach personal data that a controller collected from other sources or inferred about the consumer, given that it covers only "personal data provided by the consumer"?
- Which personal data does the exception in § 715D.3(1)(c) for "personal information" under § 715C.1 "that is subject to security breach protection" remove from the right to obtain a copy?
What it makes you log
Logging duty
Section 715D.3 sets the consumer's rights to confirm, access, delete, copy and opt out, a response within ninety days (extendable once by forty-five), a written explanation of any refusal and of an appeal decision within sixty days. Those are notices to the consumer, not a kept record, and the section names no log. The controller's burden of demonstrating that a request is manifestly unfounded or excessive is an allocation of proof for a fee or a refusal, not a record of processing. The applicability clause sits in section 715D.2(1), which this row does not cite, so no hook is taken.
- Kind
- None
- As of
What this law does
ICDPA gives an Iowa consumer the right to confirmation of processing, access, deletion, a portable copy, and an opt-out of the sale of personal data, and no right of correction or to opt out of profiling. Section 715D.3 lists no opt-out of targeted advertising, but a controller that sells personal data to third parties or engages in targeted advertising must clearly and conspicuously disclose it and the manner in which a consumer may opt out of it (section 715D.4(6)).
A controller must respond without undue delay and within 90 days of receipt, with one 45-day extension available; an appeal of a refusal must be decided within 60 days.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .