DPO SchoolDPO School

Iowa Consumer Data Protection Act (Iowa Code chapter 715D)

Iowa privacy law (ICDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must keep reasonable security, avoid discrimination, publish a privacy notice and disclose sales and targeted advertising with the way to opt out. Iowa has no data minimisation duty, no data protection assessment duty and no universal opt-out signal duty.

Key points

  1. Reasonable administrative, technical and physical security is required.

    Section: § 715D.4(1)

  2. Privacy notice must list categories of data, purposes, how to exercise and appeal rights, categories of data shared and of third parties.

    Section: § 715D.4(5)

  3. Sales and targeted advertising must be disclosed clearly with the way to opt out of such activity.

    Section: § 715D.4(6)

  4. Secure and reliable request methods are required; no new account may be demanded.

    Section: § 715D.4(7)

  5. No data minimisation, assessment or universal opt-out signal duty appears in the chapter.

    Section: § 715D.4

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Iowa statute

Reference material, not legal advice.