# Regulatory Standards — Iowa ICDPA

## Primary Legislation

### Iowa Consumer Data Protection Act — Iowa Code Chapter 715D

Enacted: March 28, 2023 (SF 262). Effective: January 1, 2025.

- **§715D.1**: Definitions (consumer, controller, processor, personal data, sensitive data, sale, targeted advertising)
- **§715D.2**: Applicability (100,000 consumers OR 25,000 + 50% revenue from sale)
- **§715D.3**: Exemptions (government, GLBA, HIPAA, nonprofits, higher ed, data-level exemptions)
- **§715D.4**: Controller duties and consumer rights (access, delete, opt-out; privacy notice; sensitive data consent)
- **§715D.5**: Processor duties and contract requirements
- **§715D.6**: AG enforcement, 90-day cure period, penalties

## Model Classification

The ICDPA follows a **business-friendly Virginia derivative** with these distinctive characteristics:
- Fewest consumer rights among comprehensive laws (no correct, no portability, no profiling opt-out)
- Longest response window (90 days vs. typical 45 days)
- Longest cure period (90 days with no sunset)
- No DPIA requirement
- No universal opt-out mechanism requirement
- AG-only enforcement (no private right of action)

## Comparison with Virginia VCDPA

| Provision | Iowa ICDPA | Virginia VCDPA |
|-----------|-----------|----------------|
| Effective date | January 1, 2025 | January 1, 2023 |
| Consumer threshold | 100,000 | 100,000 |
| Revenue threshold | 25,000 + 50% revenue | 25,000 + 50% revenue |
| Consumer rights | 3 (access, delete, opt-out) | 5 (access, correct, delete, portability, opt-out) |
| Right to correct | No | Yes |
| Right to portability | No | Yes |
| Opt-out of profiling | No | Yes |
| Sensitive data | Opt-in consent | Opt-in consent |
| DPIA required | No | Yes |
| Universal opt-out | Not required | Not required |
| Response window | 90 days | 45 days |
| Cure period | 90 days (permanent) | 30 days (permanent) |
| Enforcement | AG only | AG only |
| Penalties | $7,500/violation | $7,500/violation |

## Related Iowa Laws

### Iowa Consumer Fraud Act — Iowa Code Chapter 714H

Enforcement framework for ICDPA violations, providing the AG with established investigative and enforcement powers including civil penalties and injunctive relief.

### Iowa Personal Information Security Breach Protection — Iowa Code §715C.1-§715C.2

Requires notification to affected individuals following a security breach involving personal information. Notification must be provided within 60 days of discovery.