Compare tool
Compare state data breach notification laws
Choose up to six states. Fields come from the PRC 2026 survey extract; blanks show as not extracted.
| Field | Iowa |
|---|---|
| Statute citation | Iowa Code Ch. 715C (Personal Information Security Breach Protection) (amended 2018) |
| Individual notice timing | without unreasonable delay Iowa requires businesses to notify in the |
| Attorney general notice | Yes Iowa requires AG notification (Consumer Protection Division) within 5 business days after consumer |
| Biometric data | Yes |
| Medical information | No |
| Government ID numbers | Not extracted |
| Paper records | Yes |
| Private right of action | No |
| Credit monitoring required | No |
| Breach definition (excerpt) | In Iowa 'breach of security' means unauthorized acquisition of personal information maintained in computerized form that compromises the security, confidentiality, or integrity of the personal information. It also means unauthorized acquisition of personal information in any medium, including paper, that was transferred from computerized form. 1 |