Per Iowa Code 715D.5-1 and Iowa Personal Information Security Breach Notification Law (Iowa Code 715C separate statute) controllers and processors must implement security + breach response + records discipline. (1) Reasonable Security (Iowa Code 715D.5-1): establish + implement + and maintain reasonable administrative + technical + and physical data security practices to protect the confidentiality + integrity + and accessibility of personal data + appropriate to the volume and nature of the personal data at issue (FTC reasonable security baseline + NIST CSF + ISO 27001 alignment). (2) Iowa Breach Notification (Iowa Code 715C): separately requires controllers (database owners) holding personal information of Iowa residents (including SSN + driver license + financial account + credit card with security code + medical info + ID number + biometric) to notify (a) affected Iowa residents in the most expeditious manner possible without unreasonable delay following discovery of a breach; (b) Iowa Attorney General within 5 days of discovery if breach affects more than 500 Iowa residents; (c) any consumer reporting agencies if the breach affects more than 1000 Iowa residents. Notification content: (a) description of breach; (b) approximate date of breach; (c) type of personal information disclosed; (d) toll-free numbers for credit reporting agencies; (e) advice to remain vigilant by reviewing account statements + credit reports. Substitute notice rules apply for very large affected populations. (3) Records of Processing: while ICDPA does not explicitly require ROPA like GDPR + controllers are expected to maintain records of consumer rights requests + contracts + breach notifications + security policies + audit. (4) Encryption: while ICDPA does not mandate encryption + reasonable security practices typically include encryption at rest + in transit + key management + secure software development lifecycle. (5) Pseudonymisation: ICDPA does not explicitly address pseudonymous data + controllers should treat as personal data unless qualifying as de-identified. (6) De-Identification: per Iowa Code 715D.1-13 de-identified data exempt from ICDPA upon attestation + public commitment + contractual prohibition on re-identification. Coordinates with Iowa Breach Notification Iowa Code 715C + FTC Reasonable Security + NIST CSF + GLBA Safeguards Rule (where overlapping) + HIPAA Security Rule (where overlapping) + state attorney general guidance + similar state privacy laws + India CERT-In Directions. ICDPA Security + Breach applies.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.