Governance, risk & compliance

Iowa Consumer Data Protection Act (ICDPA) Iowa Code ch. 715D; in force 1 Jan 2025 (2023 Acts ch. 17)

The Iowa Consumer Data Protection Act is Iowa Code chapter 715D (2023 Acts ch.

17, SF 262), in force from 1 January 2025. It applies to businesses in Iowa or targeting Iowa consumers that handle the personal data of 100,000 or more consumers a year, or 25,000 or more while earning over half of revenue from selling personal data.

Nonprofits, higher education, financial institutions and HIPAA entities are exempt. It is the lightest of the state laws.

Consumers can access their data, delete the data they provided, take a copy, and opt out of the sale of personal data. There is no right to correct data and no opt-out of targeted advertising or profiling.

Responses are due in 90 days (extendable by 45) and appeals in 60 days. Sensitive data needs clear notice and a chance to opt out, not opt-in consent; known child data follows COPPA.

There is no data protection assessment duty and no universal opt-out mandate in the text read. Controllers must give a privacy notice, disclose sales and targeted advertising, provide request methods, keep reasonable security and avoid discrimination.

The Attorney General enforces alone, after a mandatory 90-day notice and cure period with no sunset, with penalties up to $7,500 per violation and no private right of action. Read from Chapter 17 of the 2023 Acts and the Iowa Code chapter PDF printed on 9 December 2025.

Iowa has no data minimization or purpose limitation duty in the text read. General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Iowa Consumer Data Protection Act (ICDPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Iowa Consumer Data Protection Act (ICDPA) compliance

Most of Iowa Consumer Data Protection Act (ICDPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Iowa Consumer Data Protection Act (ICDPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Iowa Consumer Data Protection Act (ICDPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Iowa Consumer Data Protection Act (ICDPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.