Per Iowa Code 715D.8 + 715D.9 ICDPA enforcement is exclusively vested in the Iowa Attorney General with no private right of action and offers the LONGEST cure period among US state privacy laws (90 days vs 30 days in Virginia/Indiana/Utah + 60 days original in Connecticut sunset). (1) Attorney General Exclusive (Iowa Code 715D.8): the Iowa Attorney General shall have exclusive authority to enforce a violation of this chapter + no private cause of action permitted (distinguishes ICDPA from California CCPA which has limited private right for breach + similar approach as Virginia + Connecticut + Utah + Indiana + Texas). (2) Right to Cure (Iowa Code 715D.8-2): before initiating any action for a violation the Attorney General SHALL provide a controller or processor 90 days written notice identifying the specific provisions of this chapter the Attorney General alleges have been or are being violated + if within the 90 day period the controller or processor cures the noticed violation and provides the Attorney General an express written statement that the alleged violations have been cured + and that no further violations shall occur + the Attorney General shall not initiate an action against the controller or processor. The 90-day cure provision is the LONGEST permanent cure period among US state privacy laws + Iowa CDPA is the most business-friendly cure approach. (3) Civil Penalties (Iowa Code 715D.8-3): if the Attorney General brings an action and prevails the Attorney General may seek injunction + civil penalty of up to USD 7500 per violation + reasonable expenses incurred in investigating and preparing the case including attorney fees - penalties go to State General Fund. (4) Compliance Demonstration: controller may demonstrate compliance through privacy notice + contracts + record-keeping. (5) Industry Self-Regulation: controllers may join industry self-regulation programs (e.g. NAI Network Advertising Initiative + DAA Digital Advertising Alliance Self-Regulation + IAB CCPA Compliance Framework + IAB TCF Transparency and Consent Framework) to demonstrate compliance though not safe harbour. (6) AG Investigation Cooperation: when AG investigates controller or processor shall cooperate including production of privacy notice + breach records + records of consumer rights requests + processor contracts + audit records. (7) Voluntary Compliance: AG may issue informal guidance + best practices + compliance assistance programs. Coordinates with similar US state privacy laws enforcement (Virginia 30-day permanent + Colorado 60-day sunsetted + Utah 30-day permanent + Connecticut 60-day sunsetted + Indiana 30-day permanent + Texas 30-day permanent + Tennessee 30-day permanent + Montana + Oregon + Delaware + New Jersey + Maryland + Kentucky + Rhode Island + Nebraska) + FTC Section 5 + state UDAP statutes + India DPDP + GDPR Arts 83 + 84. ICDPA Enforcement + 90-Day Cure + AG Only + No PRA + USD 7500 Per Violation applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.