Law / United States / 
Iowa
Iowa Consumer Data Protection Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Expect ICDPA violations to be enforced exclusively by the Iowa Attorney General, never by a private plaintiff.
- Cure a noticed violation and provide a written statement of cure within 90 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, this cure right carries no sunset date in the statutory text.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Is a "violation" counted per consumer, per request, or per practice when the Attorney General seeks civil penalties of up to $7,500 "for each violation" under Iowa Code § 715D.8(3)?
- Does "under any other law" in § 715D.8(4) stop a consumer from using a violation of chapter 715D as the basis for a private claim under another Iowa statute?
What it makes you log
Who may demand the log
Regulator
Logging duty
Section 715D.8 gives the Attorney General exclusive enforcement authority, a civil investigative demand on reasonable cause, a ninety-day written notice and cure period, civil penalties of up to $7,500 for each violation, and no private right of action. The demand is a power to compel information about a violation, with no record named, so it is not a duty to log. The cure statement the controller or processor gives the Attorney General is a statement, not a record the business keeps. The applicability clause sits in section 715D.2(1), which this row does not cite, so no hook is taken.
- Kind
- None
- As of
What this law does
The Iowa Attorney General has exclusive authority to enforce ICDPA. Before suing, the Attorney General must give a controller or processor 90 days' written notice identifying the specific provisions violated; unlike Connecticut's, Delaware's, and Montana's time-limited or eliminated cure rights, this 90-day cure right carries no sunset date in the text read. Civil penalties run up to $7,500 per violation, and the chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .