DPO SchoolDPO School

Iowa Consumer Data Protection Act (Iowa Code chapter 715D)

Iowa privacy law (ICDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General enforces the chapter exclusively after a permanent 90-day notice and cure period. Civil penalties are up to $7,500 per violation. There is no private right of action.

Key points

  1. Exclusive enforcement by the Attorney General, who may issue civil investigative demands.

    Section: § 715D.8(1)

  2. 90 days' written notice and a chance to cure, with an express written statement; no sunset.

    Section: § 715D.8(2)

  3. Injunction and civil penalties of up to $7,500 per violation.

    Section: § 715D.8(3)

  4. No private right of action.

    Section: § 715D.8(4)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Iowa statute

Reference material, not legal advice.