Iowa Consumer Data Protection Act ICDPA-Scope-SF262-2023-Kim-Reynolds-IA-Code-715D-Effective-1Jan2025-Applicability-100K-25K-50pct-Utah-Template: Iowa CDPA Scope + Senate File 262 + Governor Kim Reynolds 28 March 2023 + Iowa Code Chapter 715D + Effective 1 January 2025 + Applicability Thresholds + Utah CDPA Template Parent + Exemptions
Iowa Consumer Data Protection Act (ICDPA) enacted as Senate File 262 (SF 262) of the 90th Iowa General Assembly + signed by Governor Kim Reynolds on 28 March 2023 + codified at Iowa Code Chapter 715D. Effective date: 1 January 2025. Iowa 6th US state to enact comprehensive consumer data privacy law (after California CCPA/CPRA + Virginia VCDPA + Colorado CPA + Utah UCPA + Connecticut CTDPA). Modeled closely on Utah Consumer Privacy Act (UCPA) template - among the most business-friendly US state privacy laws + narrower than VCDPA template + omits some consumer rights provisions. Applicability per Iowa Code 715D.2: applies to persons that conduct business in Iowa or produce products or services that are targeted to Iowa consumers and that during a calendar year (a) control or process personal data of at least 100000 Iowa consumers; or (b) control or process personal data of at least 25000 Iowa consumers AND derive more than 50 percent of gross revenue from the sale of personal data. Exemptions per Iowa Code 715D.3: (1) State + political subdivisions; (2) financial institutions or data subject to Title V of the Gramm-Leach-Bliley Act (GLBA); (3) Covered Entity or Business Associate per HIPAA; (4) nonprofits; (5) institutions of higher education; (6) data subject to Fair Credit Reporting Act (FCRA); (7) data subject to Family Educational Rights and Privacy Act (FERPA); (8) Driver Privacy Protection Act; (9) Farm Credit Act; (10) clinical trial data subject to Federal Common Rule; (11) employment data + B2B data exempted; (12) data subject to other specific federal laws. Definitions: Consumer = natural person who is a resident of Iowa acting only in an individual or household context (NOT employees + commercial actors); Controller = person that determines the purpose and means of processing personal data; Processor = person who processes personal data on behalf of a controller; Personal Data = information that is linked or reasonably linkable to identifiable or identified natural person (NOT publicly available + NOT deidentified + NOT aggregated); Sensitive Data per Iowa Code 715D.1(28) includes (a) racial or ethnic origin + religious beliefs + mental or physical health diagnosis + sexual orientation + citizenship/immigration status; (b) genetic or biometric data processed to uniquely identify; (c) personal data collected from a known child (under 13 per COPPA); (d) precise geolocation data (within radius of 1750 feet). Sale of Personal Data: defined NARROWLY (Utah template) as exchange for monetary consideration only (does NOT include exchange for other valuable consideration unlike Virginia + Colorado + Connecticut + Indiana). Public + freely available via legis.iowa.gov. Coordinates with similar US state privacy laws (Utah UCPA template parent + Virginia VCDPA + Colorado CPA + Connecticut CTDPA + Indiana INCDPA + Tennessee TIPA + Montana MCDPA + Texas TDPSA + Oregon OCPA + Delaware DPDPA + New Jersey NJDPA + Maryland MODPA) + federal sectoral laws (HIPAA + GLBA + FCRA + FERPA + COPPA + DPPA) + GDPR + India DPDP Act. Iowa Code 715D + ICDPA Scope + SF 262 + Applicability applies.
Maintained by Gerard Blokdyk·Verified against the published standard ·Control text last updated
What else in your programme already covers this
This control maps to 76 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
ItalyCodice-Garante-Enforcement-AdministrativeSanctions-Criminal-Art166-167-170-20MEUR-Coord-EDPB Italy Codice Garante Authority + Article 140-bis + Article 144 Complaints + Article 166 Administrative Sanctions up to EUR 20M/4% + Article 167 Criminal Offences + Article 170 Failure to Comply with Garante Orders + EDPB Coordination
ItalyCodice-ePrivacy-Cookies-ElectronicCommunications-Telemarketing-PublicOpposition-TrafficDataRetention-Art121-122-130-132 Italy Codice ePrivacy - Article 121 Electronic Communications + Article 122 Cookies and Tracking + Article 130 Unsolicited Direct Marketing + Article 132 Traffic Data Retention + Italian Public Opposition Register (Registro delle Opposizioni)