Iowa Consumer Data Protection Act (ICDPA), general applicability and controller/processor duties

Iowa Code ch. 715D, §§ 715D.2, 715D.4, 715D.5

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A comprehensive regime rule binding private bodies.

As of 27 August 2026.

What it requires

Confirm you conduct business in Iowa, or produce a product or service used by Iowa residents, and process or sell personal data before relying on ICDPA's scope in compliance planning.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed March 28, 2023 (2023 Iowa Acts ch. 17), effective January 1, 2025 per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.

When LexLint raises it

automated_outreach
crawls_web
deploys_chatbot
processes_biometrics
processes_voice
trains_models

Read the law

official Iowa statute text, Iowa Code chapter 715D

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app