Privacy Law Library

Personal Information Security Breach Protection

Iowa Breach Notification Law

Breach notification · Data security · Biometric

Iowa's breach law requires anyone who owns or licenses computerized personal information of Iowa residents to notify affected residents of a breach of security without unreasonable delay, and to notify the Attorney General within five business days if more than 500 Iowans are notified. It also covers paper records that were printed from computerized form. Notice is not required if a documented investigation finds no reasonable likelihood of financial harm.

Where
Iowa
Citation
Iowa Code ch. 715C (715C.1 to 715C.2)
Status
In force
In force since
2008-07-01
Last amended
2018-07-01
Enforced by
Iowa Attorney General (Consumer Protection Division), as an unlawful practice under Iowa Code 714.16
People can sue
No
Penalties
A violation is an unlawful practice under the Consumer Fraud Act (714.16): injunction, restitution, and civil penalties of up to $40,000 per violation; the Attorney General may also obtain damages on behalf of injured persons (715C.2(9)). Remedies are cumulative with other law.
Applies to
  • Any person (including businesses, individuals, and government bodies) that owns or licenses computerized data including an Iowa resident's personal information used in the course of business, vocation, occupation, or volunteer activities (715C.2(1))
  • Any person that maintains personal information on behalf of another person (715C.2(2))
  • Personal information: first name or initial and last name plus SSN, driver's license or other government ID number, financial account or card number with access code, electronic identifier or routing code with access code, or unique biometric data, where unencrypted or the key was also taken (715C.1(11))
  • Deemed compliant: entities following their federal functional regulator's rules, laws giving greater protection, GLBA Title V, or HIPAA/HITECH (715C.2(7))

Breach duties

  • Notify affected Iowa residents of a breach of security in the most expeditious manner possible and without unreasonable delay, subject to law-enforcement needs and steps to determine scope and restore security.Iowa Code 715C.2(1)
  • A person maintaining personal information for another must notify the owner or licensor immediately after discovering a breach.Iowa Code 715C.2(2) · Only if: Entity maintains data on behalf of another
  • Notice may be delayed on a written request from law enforcement that notice would impede a criminal investigation.Iowa Code 715C.2(3)
  • Notice must describe the breach, its approximate date, the type of information obtained, contact information for consumer reporting agencies, and advice to report suspected identity theft to local law enforcement or the Attorney General.Iowa Code 715C.2(5)(a)-(e)
  • Notice may be written, electronic (if that is the customary method), or substitute notice (email, website posting, and statewide media) if costs exceed $250,000, more than 350,000 people are affected, or contact information is insufficient.Iowa Code 715C.2(4)
  • Give written notice to the director of the Attorney General's Consumer Protection Division within five business days after notifying consumers when more than 500 Iowa residents must be notified. The Attorney General's Office accepts these filings through an online submission page and publishes notices by year.Iowa Code 715C.2(8) · Only if: Breach requires notice to more than 500 Iowa residents

Other duties

  • A decision that no notice is needed (no reasonable likelihood of financial harm) must follow an appropriate investigation or consultation with law enforcement, be documented in writing, and be kept for five years.Iowa Code 715C.2(6)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: 2008-07-01 effective date (2008 Acts ch. 1154) is inferred from the Iowa Code 3.7 default July 1 rule; the 2008 session law was not opened. The 2018 amendments (2018 Acts ch. 1091, SF 2177, approved April 10, 2018) contain effective-date clauses only for the 714G freeze sections, so the 715C changes took effect July 1, 2018.

Research reference, not legal advice.