Law: An Act relating to consumer data protection (ICDPA)

Regulator: The Iowa Attorney General (AG)

Summary: On March 28, 2023, the Iowa State Governor signed the Act relating to consumer data protection (ICDPA) which will enter into effect on January 1, 2025. The ICDPA introduces obligations for data controllers and processors, including disclosure, and vendor management requirements. It also establishes new consumer rights such as the right to access, deletion, be informed (confirmation), and to opt out of targeted advertising and the sale of personal data. However, the ICDPA does not provide for the right to rectification of personal data and the right not to be subject to automated decision-making. Furthermore, the ICDPA provides the Iowa Attorney General (AG) with enforcement powers but does not provide a private right of action.

In addition, under §715C.1 et seq. of Title XVI of the Iowa Code, there is a requirement to notify personal data breaches of both electronic and paper records to affected consumers as well as to the AG when the information of more than 500 residents is breached.

Other applicable privacy statutes in Iowa are sector-specific, such as the Iowa Student Online Personal Information Protection Act and the Iowa Health Information Network Act.

You can follow legislative developments in the US through the USA State Law Tracker.