# Iowa ICDPA Compliance Assessment

## Organization Information

| Field | Value |
|-------|-------|
| **Organization** | Liberty Commerce Inc. |
| **Assessment Date** | 2026-03-16 |
| **ICDPA Effective Date** | January 1, 2025 |
| **Iowa Consumer Count** | 52,000 |
| **Revenue from Sale** | 12% |
| **Applicable** | Below thresholds; monitoring for growth |

## Applicability Determination

| Criterion | Result |
|-----------|--------|
| Iowa business nexus | Yes |
| Consumer count >= 100,000 | No (52,000) |
| Consumer count >= 25,000 AND revenue > 50% | No (52,000 consumers, 12% revenue) |
| Entity-level exemption | Not applicable |
| **Determination** | **Not subject to ICDPA; voluntary compliance maintained** |

## Readiness Checklist

| # | Item | Section | Category | Status |
|---|------|---------|----------|--------|
| IA-01 | Applicability determination | §715D.2 | Legal | Complete |
| IA-02 | Privacy notice updated | §715D.4(6) | Legal | Complete |
| IA-03 | Consumer rights portal (access, delete, opt-out) | §715D.4 | Technical | Complete |
| IA-04 | Opt-out mechanisms (sale, targeted ads) | §715D.4(1)(c) | Technical | Complete |
| IA-05 | Sensitive data consent | §715D.4(4) | Technical | Complete |
| IA-06 | 90-day SLA monitoring | §715D.5 | Operations | Complete |
| IA-07 | Appeal process (60-day SLA) | §715D.5 | Operations | Complete |
| IA-08 | Processor contracts updated | §715D.5 | Legal | Complete |
| IA-09 | Staff training completed | General | Operations | Complete |
| IA-10 | Data minimization controls | §715D.4(2) | Technical | Complete |
| IA-11 | Data security practices | §715D.4(3) | Technical | Complete |
| IA-12 | AG cure period response plan | §715D.6(2) | Legal | Complete |

**Readiness: 100%**

## Iowa-Specific Compliance Notes

| Feature | Iowa Requirement | Implementation |
|---------|-----------------|----------------|
| Consumer rights | Access, delete, opt-out only | Portal configured for 3 rights |
| Response window | 90 days | SLA set at 90 days |
| Cure period | 90 days | Response plan with 90-day timeline |
| DPIA | Not required | Conducted voluntarily for multi-state |
| Universal opt-out | Not required | GPC honored voluntarily |

## Sign-Off

| Role | Name | Date |
|------|------|------|
| CPO | Sarah Mitchell | 2026-03-16 |
| Legal | Marcus Chen | 2026-03-16 |