Law / United States / 
Iowa
Iowa Consumer Data Protection Act (ICDPA), general applicability and controller/processor duties
Iowa Code ch. 715D, §§ 715D.2, 715D.4, 715D.5
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Confirm you conduct business in Iowa, or produce a product or service used by Iowa residents, and process or sell personal data before relying on ICDPA's scope in compliance planning.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a business produce products or services "targeted to consumers who are residents of the state" under Iowa Code § 715D.2(1) when it offers a nationwide online service that is not directed at Iowa in particular?
- Which definition of "financial institutions" applies to the entity exemption in § 715D.2(2), given that chapter 715D does not define the term?
What it makes you log
Who may demand the log
Counterparty
Logging duty
Section 715D.5(2)(c) makes the contract between controller and processor require that the processor, on the controller's reasonable request, make available all information in its possession necessary to demonstrate its compliance with the chapter. That cannot be met without records of the processing the processor keeps, but the section names no log, field or period, so no contents or retention are taken. The access is the controller's, under the contract, and no regulator or auditor is named in sections 715D.2, 715D.4 or 715D.5; the Attorney General's civil investigative demand sits in section 715D.8, which this row does not cite. The privacy notice in 715D.4(5) states the controller's practices and is not a record of processing.
- Kind
- Implicit
- As of
- Provision
- Iowa Code 715D.5(2)(c)
- Trigger
- personal_data_processing
What this law does
ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed (2023 Iowa Acts ch. 17), effective per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .