Law note · Iowa
Iowa Consumer Data Protection Act (ICDPA), general applicability and controller/processor duties
ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed March 28, 2023 (2023 Iowa Acts ch. 17), effective January 1, 2025 per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text in this pass, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.
What it asks of an app
- Confirm you conduct business in Iowa, or produce a product or service used by Iowa residents, and process or sell personal data before relying on ICDPA's scope in compliance planning.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Iowa statute text, Iowa Code chapter 715D