DPO SchoolDPO School

Iowa Consumer Data Protection Act (Iowa Code chapter 715D)

Iowa privacy law (ICDPA): processors

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Processors must help the controller with consumer requests, security and breach notice. A contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance and written subcontracts. Iowa does not require assessment or audit terms.

Key points

  1. Processors must assist with consumer requests, security and breach notification.

    Section: § 715D.5(1)

  2. Contract must set out instructions, nature and purpose, data types, duration, and the rights and duties of both parties.

    Section: § 715D.5(2)

  3. Required terms: confidentiality, deletion or return, information to show compliance, and written subcontracts.

    Section: § 715D.5(2)(a)-(d)

  4. Whether a person is a controller or processor is a fact-based question.

    Section: § 715D.5(4)

Sources

Compare processors across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Iowa statute

Reference material, not legal advice.