DPO SchoolDPO School

Iowa Consumer Data Protection Act (Iowa Code chapter 715D)

Iowa privacy law (ICDPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The chapter applies to persons doing business in Iowa or targeting Iowa consumers that, in a calendar year, handle personal data of at least 100,000 consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, persons subject to and complying with HIPAA, nonprofits and higher education institutions are exempt as entities.

Key points

  1. Thresholds: 100,000 consumers, or 25,000 consumers plus more than 50% of gross revenue from sales, in a calendar year.

    Section: § 715D.2(1)

  2. GLBA: financial institutions, their affiliates and data subject to GLBA Title V are exempt.

    Section: § 715D.2(2)

  3. Persons subject to and complying with HIPAA and HITECH rules are exempt; protected health information is also exempt as data.

    Section: § 715D.2(2), (3)(a)

  4. Nonprofits and institutions of higher education are exempt.

    Section: § 715D.2(2)

  5. Employee, applicant and contractor data used in that role is exempt.

    Section: § 715D.2(3)(q)

  6. Sale means exchange for monetary consideration only.

    Section: § 715D.1(25)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Iowa statute

Reference material, not legal advice.