Iowa Consumer Data Protection Act
Iowa CDPA Processor Contracts

Iowa Consumer Data Protection Act ICDPA-Processor-Contracts-DPA-Subprocessor-Confidentiality-Audit-EndOfContract-Iowa-Code-715D-7: Iowa CDPA Processor Contracts - Data Processing Agreement (DPA) + Required Provisions + Subprocessor Approval + Confidentiality + End of Contract Deletion + Audit Rights + Assistance

Per Iowa Code 715D.7 ICDPA imposes contractual requirements on the relationship between controller and processor. (1) Processor Obligations: a processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller obligations under this chapter by following the directions of the controller. (2) Contract Required: a contract between a controller and a processor shall govern the processor data processing procedures with respect to processing performed on behalf of the controller. The contract shall be binding and clearly set forth: (a) instructions for processing data; (b) the nature and purpose of processing; (c) the type of data subject to processing; (d) the duration of processing; (e) the rights and obligations of both parties. (3) Confidentiality: contract shall require that the processor shall ensure that each person processing personal data is subject to a duty of confidentiality with respect to the personal data. (4) Subprocessor Approval: contract shall require that the processor shall engage any subcontractor only after providing the controller with an opportunity to object and shall require the subcontractor to meet the obligations of the processor with respect to the personal data through a written contract. (5) Audit Rights: contract shall require that the processor shall make available to the controller all information necessary to demonstrate the processor compliance with the obligations + and allow for + and contribute to + reasonable audits and inspections by the controller or the controller designated assessor + at the controller expense. (6) End of Contract: contract shall require that at the controller direction the processor shall delete or return all personal data to the controller as requested at the end of the provision of services unless retention of the personal data is required by law. (7) Assistance with Consumer Requests: processor shall assist controller in fulfilling consumer rights requests. (8) Determination Test: a person that is a processor with respect to one set of processing activities may be a controller with respect to a different set of processing activities + the determination of controller vs processor is fact-specific based on context. Coordinates with GDPR Art 28 + DPA template + similar state privacy laws + CCPA service provider/contractor agreement + FTC reasonable security + business contract law. ICDPA Processor Contracts applies.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 50 controls across 23 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Regulation on the European Health Data Space (EHDS) · 4 controls

  • EHDS-HOLD-3 Dataset Descriptions and Catalogues
  • EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29)
  • EHDSREG-4 Digital Health Authorities, Governance, MyHealth@EU
  • EHDSREG-5 Cross-Border Health Data Flows

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 4 controls

Bahrain PDPL · 3 controls

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 3 controls

  • UAE-PDPL-Art.18_19_20_21 Security measures, controller/processor relationship, DPIA (UAE PDPL Articles 18-21)
  • UAE-PDPL-Art.22_23_24 Cross-border data transfers (UAE PDPL Articles 22-24)
  • UAE-PDPL-FreeZones Coordination with DIFC, ADGM and sectoral data protection regimes

Privacy Act 1988 (Australia) · 3 controls

  • AUPRV-3 APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers
  • AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children
  • AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement

Albania Law No. 124/2024 on Personal Data Protection · 2 controls

  • AL-DPA-14 Direct Marketing
  • AL-DPA-7 Right of Access

DAMA-DMBOK2 - Data Management Body of Knowledge (2nd Edition) · 2 controls

  • DIQ-2 Data Quality Management
  • DIQ-3 Metadata Management

Ecuador Ley Orgánica de Protección de Datos Personales (LOPDP) · 2 controls

  • LOPDP-EC-Cross-Border-Transfers-Articles-59-65-Adequacy-SCC-BCR-EU-Schrems-LatAm-CBPR-Andean-Community Ecuador LOPDP Cross-Border + Articles 59-65 + Adequacy + Andean Community + LatAm
  • LOPDP-EC-Governance-DPO-ROPA-DPIA-Privacy-by-Design-Training-Articles-46-58-Compliance-Monitoring Ecuador LOPDP Governance + DPO + ROPA + DPIA + Privacy by Design + Training

IEEE 7000 · 2 controls

  • IEEE7000-Operations-Lifecycle-OngoingMonitoring-Incident-Decommissioning IEEE 7000 - Operations + Lifecycle + Ongoing AI Risk Monitoring + Data Provenance + Retention + Privacy + Safe Deployment + Decommissioning + Disposal
  • IEEE7000-Values-Elicitation-Prioritisation-IEEE7000Family-Bias-Privacy-Transparency IEEE 7000 Clauses 6 + 6.1 - Ethical Values Elicitation + Prioritisation + IEEE 7000 Family Integration (Bias + Privacy + Transparency + Wellbeing)

Iceland Data Protection and Processing of Personal Data Act (Act No. 90/2018) · 2 controls

Indiana Consumer Data Protection Act · 2 controls

  • INCDPA-Processor-Contracts-DPA-Subprocessor-Audit-Confidentiality-EndOfContract Indiana CDPA Processor Contracts - Data Processing Agreement (DPA) + Required Provisions + Subprocessor Approval + Confidentiality + End of Contract Deletion + Audit Rights + Assistance
  • INCDPA-Security-ReasonablePractices-Breach-Notification-Records-Encryption-Pseudonymisation Indiana CDPA Security + Reasonable Practices + Breach Notification + Indiana Breach Notification Law (IC 24-4.9) + Records + Encryption + Pseudonymisation + De-Identification

Law No. 172-13 on the Protection of Personal Data · 2 controls

  • DOM172-Cross-Border-Transfer-Article-80-Vendor-Processor-Management-Marketing-Direct-Communications-Article-23-24-26 Dominican Republic Law 172-13 Cross-Border Transfer + Vendor Management + Marketing + Articles 23-24-26-80
  • DOM172-Supervisory-Authority-Cooperation-Sanctions-Penalties-Articles-77-79-Awareness-Training-Retention-DPO-Designation Dominican Republic Law 172-13 Supervisory Authority + Sanctions + Articles 77-79 + DPO + Awareness

Armenia Law on Protection of Personal Data (2015) · 1 control

Australian Privacy Principles (APPs) · 1 control

  • APP-8 APP 8 - Cross-border disclosure of personal information

Azerbaijan Law on Personal Data (2010) · 1 control

  • AZ-DPA-12 Article 13 - Cross-border transfer

Barbados Data Protection Act 2019 · 1 control

  • BB-DPA-17 Section 24 - Appropriate Safeguards

GDPR · 1 control

  • GDPR-Art.45 Transfers on the basis of an adequacy decision

Indonesia PDP Law · 1 control

Pakistan Personal Data Protection Bill 2023 · 1 control

  • PAKPDPB-6 Cross-Border Transfer and Data Localization

Russia Federal Law on Personal Data (152-FZ) · 1 control

  • RUSPD-4 Special Categories, Biometric Data

Singapore AI Governance Framework · 1 control

  • AIGF-1.3 Data Management

USMCA Chapter 19 - Digital Trade (United States-Mexico-Canada Agreement) · 1 control

  • USMCADIGITAL-1 Cross-Border Data Flows and Localisation

Vietnam Law on Cybersecurity (No. 116/2025/QH15) · 1 control

  • VIETNAMCYBER-3 Data Localization and Cross-Border

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 50 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Iowa Consumer Data Protection Act controls