Iowa Consumer Data Protection Act (ICDPA) enacted as Senate File 262 (SF 262) of the 90th Iowa General Assembly + signed by Governor Kim Reynolds on 28 March 2023 + codified at Iowa Code Chapter 715D. Effective date: 1 January 2025. Iowa 6th US state to enact comprehensive consumer data privacy law (after California CCPA/CPRA + Virginia VCDPA + Colorado CPA + Utah UCPA + Connecticut CTDPA). Modeled closely on Utah Consumer Privacy Act (UCPA) template - among the most business-friendly US state privacy laws + narrower than VCDPA template + omits some consumer rights provisions. Applicability per Iowa Code 715D.2: applies to persons that conduct business in Iowa or produce products or services that are targeted to Iowa consumers and that during a calendar year (a) control or process personal data of at least 100000 Iowa consumers; or (b) control or process personal data of at least 25000 Iowa consumers AND derive more than 50 percent of gross revenue from the sale of personal data. Exemptions per Iowa Code 715D.3: (1) State + political subdivisions; (2) financial institutions or data subject to Title V of the Gramm-Leach-Bliley Act (GLBA); (3) Covered Entity or Business Associate per HIPAA; (4) nonprofits; (5) institutions of higher education; (6) data subject to Fair Credit Reporting Act (FCRA); (7) data subject to Family Educational Rights and Privacy Act (FERPA); (8) Driver Privacy Protection Act; (9) Farm Credit Act; (10) clinical trial data subject to Federal Common Rule; (11) employment data + B2B data exempted; (12) data subject to other specific federal laws. Definitions: Consumer = natural person who is a resident of Iowa acting only in an individual or household context (NOT employees + commercial actors); Controller = person that determines the purpose and means of processing personal data; Processor = person who processes personal data on behalf of a controller; Personal Data = information that is linked or reasonably linkable to identifiable or identified natural person (NOT publicly available + NOT deidentified + NOT aggregated); Sensitive Data per Iowa Code 715D.1(28) includes (a) racial or ethnic origin + religious beliefs + mental or physical health diagnosis + sexual orientation + citizenship/immigration status; (b) genetic or biometric data processed to uniquely identify; (c) personal data collected from a known child (under 13 per COPPA); (d) precise geolocation data (within radius of 1750 feet). Sale of Personal Data: defined NARROWLY (Utah template) as exchange for monetary consideration only (does NOT include exchange for other valuable consideration unlike Virginia + Colorado + Connecticut + Indiana). Public + freely available via legis.iowa.gov. Coordinates with similar US state privacy laws (Utah UCPA template parent + Virginia VCDPA + Colorado CPA + Connecticut CTDPA + Indiana INCDPA + Tennessee TIPA + Montana MCDPA + Texas TDPSA + Oregon OCPA + Delaware DPDPA + New Jersey NJDPA + Maryland MODPA) + federal sectoral laws (HIPAA + GLBA + FCRA + FERPA + COPPA + DPPA) + GDPR + India DPDP Act. Iowa Code 715D + ICDPA Scope + SF 262 + Applicability applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.