Iowa Consumer Data Protection Act ICDPA-ConsumerRights-Access-Delete-Portability-OptOut-Sale-Appeal-90Day-NO-Right-To-Correction-Authorised-Agent: Iowa CDPA Consumer Rights - Access + Delete + Portability + Opt-Out of Sale + 90-Day Response + Appeal + Authorised Agent + NO Right to Correction + NO Profiling Opt-Out + Free First Per Year
Iowa CDPA grants Iowa consumers 5 core rights subject to verifiable consumer request procedures per Iowa Code 715D.4. Iowa CDPA rights are NARROWER than other US state privacy laws - notably NO Right to Correction (unique among major state privacy laws as of 2026) and NO Profiling Opt-Out for legal/significant effects. (1) Right to Confirm + Access (Iowa Code 715D.4-1): consumer may confirm whether or not a controller is processing the consumer personal data and to access such personal data. (2) Right to Delete (Iowa Code 715D.4-2): consumer may delete personal data provided by the consumer (note: only data PROVIDED BY consumer, not data OBTAINED ABOUT consumer - narrower than Virginia/Colorado/Connecticut). (3) Right to Portability (Iowa Code 715D.4-3): consumer may obtain a copy of consumer personal data that the consumer previously provided to the controller in a portable and to the extent technically feasible readily usable format. (4) Right to Opt-Out of Sale of Personal Data (Iowa Code 715D.4-4): consumer may opt out of the processing of personal data for purposes of (a) targeted advertising (Iowa Code 715D.4-4(a)); (b) sale of personal data (narrow monetary definition only). NO Profiling Opt-Out (distinguishes Iowa from VCDPA/CPA/CTDPA/INCDPA which all include profiling opt-out). (5) Right to Appeal (Iowa Code 715D.4-7): if controller declines to take action on a consumer rights request the consumer may appeal within reasonable period + controller shall respond within 60 days + provide written explanation + inform consumer of right to file complaint with Iowa Attorney General. Response Timelines: controller shall respond to consumer rights requests within 90 days of receipt + may extend by additional 45 days where reasonably necessary (135 days total maximum - longer than VCDPA/CPA/CTDPA 45+45 = 90 day max). Authorised Agent: consumer may designate authorised agent to exercise opt-out rights on their behalf + universal opt-out signal recognition NOT mandatory (distinguishes from Colorado CPA + Connecticut CTDPA which both mandate Global Privacy Control GPC recognition). Free of Charge: first consumer rights exercise per consumer per 12 month period free + subsequent requests within 12 months may incur reasonable fee or controller may decline. Identity Verification: controller may require verification of consumer identity. Anti-Discrimination (Iowa Code 715D.5-3): controller shall not discriminate against consumer for exercising rights + may NOT deny goods/services + charge different prices + provide different quality. Coordinates with GDPR Arts 15-22 + CCPA + UCPA + VCDPA + CPA + CTDPA + INCDPA + FTC Act Section 5. Iowa CDPA Consumer Rights applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 109 controls across 48 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.