Iowa Consumer Data Protection Act (ICDPA)
Complete compliance guide for companies with <200 employees. Everything you need to know about ICDPA requirements, deadlines, and penalties.
90 calendar days
+ 45 days extension
$7,500/violation
Up to $7,500 per violation under the Iowa Consumer Fraud Act. The AG must provide a 90-day cure period before enforcement — this cure period has no sunset date, making ICDPA one of the most business-friendly US state privacy laws alongside Utah's UCPA.
100,000 consumers
$3,000 – $10,000
3-8 weeks
Mid-Market Compliance Guide
Iowa's ICDPA is one of the most business-friendly US state privacy laws. It features the longest DSAR response deadline at 90 days (vs. 45 days in most states), a permanent 90-day cure period with no sunset, and does NOT include a right to correct. The threshold is 100,000+ consumers or 25,000+ consumers with 50%+ revenue from data sales. Total maximum response time with extension is 135 days.
Key Requirements
- Provide a clear and accessible privacy notice
- Obtain consent before processing sensitive data
- Provide a method for consumers to opt out of sale and targeted advertising
- Implement and maintain reasonable data security practices
- Establish data processing agreements with processors
Consumer Rights
Business Obligations
- 1.Provide privacy notice disclosing data categories, purposes, and rights
- 2.Respond to consumer requests within 90 days
- 3.Implement reasonable security measures
- 4.Execute data processing agreements with processors
Exemptions
- •HIPAA-covered entities and data
- •GLBA-covered financial institutions
- •Nonprofits
- •Government entities
- •Higher education institutions
Related Privacy Laws
Recommended Compliance Tools
No vendors have been reviewed for ICDPA coverage yet.
Browse all compliance toolsGet a mid-market compliance checklist for ICDPA
We'll send you a practical, step-by-step checklist tailored for companies with <200 employees. No spam, unsubscribe anytime.
See how DPAs enforce ICDPA in practice
Real fines, real violations, real lessons. Browse our enforcement database to understand what gets penalized under ICDPA.
Disclaimer: This is general information, not legal advice. Consult a qualified attorney for your specific situation. Laws and regulations may change. Last reviewed: 3/3/2026.