Data Breach Notice to Residents and State Authorities in Iowa
At a glance
| Covered entity and service provider | Owner/licensee of computerized PI used in business, vocation, occupation, or volunteer activities notifies residents; nonowner holder tells owner/licensor immediately after discovery (§ 715C.2(1)-(2)) |
|---|---|
| Breach and covered information | Unauthorized acquisition of computerized PI or paper copied from computerized form; name plus ID, financial-access, or biometric data; compromised keys can count (§ 715C.1(1),(11)) |
| Risk screen or notice exception | No notice if proper investigation or law-enforcement consultation finds no reasonable likelihood of financial harm; written determination kept five years (§ 715C.2(6)) |
| Individuals who receive notice | Iowa residents whose PI was included in breached information (§§ 715C.1(2), 715C.2(1)) |
| Individual notice deadline and clock | Most expeditious manner possible without unreasonable delay after discovery or owner notification; scope/contact/system work allowed; no fixed outer day limit (§ 715C.2(1)) |
| Regulator threshold and deadline | More than 500 Iowa residents requiring notice; written notice to AG consumer protection division within five business days after first consumer notice (§ 715C.2(8)) |
| Consumer-reporting-agency notice | No separate reporting-agency notice in Chapter 715C; resident letter must include agency contact information (§ 715C.2(5)(d)) |
| Individual delivery and content | Written or qualifying electronic notice; letter states breach description/date, data type, reporting-agency contacts, and identity-theft reporting advice (§ 715C.2(4)-(5)) |
| Substitute notice conditions and channels | Cost over $250,000, affected class over 350,000, or insufficient contacts: email if available AND website post/link if maintained AND statewide media (§ 715C.2(4)(c)) |
| Delays and alternate compliance | Written law-enforcement delay request until written clearance; qualifying federal/state or GLBA/HIPAA-HITECH compliance routes (§ 715C.2(3),(7)) |
Requirements one by one
The breach and risk decision
Iowa Code § 715C.1(1) covers unauthorized acquisition of personal information in computerized data and paper records transferred from computerized form. Section 715C.1(11) covers a name with a Social Security number, a government identification number, financial account access data, or biometric data. Compromised decryption keys can bring protected data within the definition; lawfully public information is excluded. Good-faith acquisition for a legitimate purpose is excluded unless the information is unlawfully used or threatens its security, confidentiality, or integrity.
Under § 715C.2(6), notice is unnecessary when an appropriate investigation or consultation with relevant law enforcement supports a determination of no reasonable likelihood of financial harm. That decision must be written and kept for five years.
Resident, owner, and Attorney General notice
Section 715C.2(1) requires the owner or licensee to notify each Iowa resident whose information was in the breached set, in the most expeditious manner possible and without unreasonable delay after discovery or notice from a nonowner holder. It permits work to find contacts, scope the breach, and restore system integrity. It gives no fixed outer day limit. Under subsection (2), a nonowner data holder notifies the owner or licensor immediately following discovery.
If the breach requires notice to more than 500 Iowa residents, § 715C.2(8) requires a written report to the director of the Attorney General's consumer protection division within five business days after the first consumer notice. Chapter 715C does not impose a separate report to nationwide consumer reporting agencies; subsection (5)(d) instead requires their contact information in the resident notice.
Delivery and letter contents
Section 715C.2(4) allows written notice to the last available address or qualifying electronic notice. If direct notice would cost over $250,000, the affected class exceeds 350,000, or contacts are insufficient, substitute notice requires email where available, a conspicuous website notice or link if maintained, and major statewide media.
Section 715C.2(5) requires the consumer letter to describe the breach, its approximate date, the type of information obtained, consumer-reporting-agency contacts, and advice to report suspected identity theft to local law enforcement or the Attorney General.
What trips people up
The Attorney General clock starts after residents are notified. Section 715C.2(8) counts five business days from giving notice to any consumer, once the more-than-500-resident threshold is met.
A police delay takes two written steps. Under § 715C.2(3), the agency must request delay in writing after finding notice would impede a criminal investigation. Notice follows after the agency gives written clearance.
Alternative compliance has a high bar. Section 715C.2(7) recognizes qualifying federal-regulator procedures or another state or federal law only if they provide greater data protection and at least as thorough disclosure. It also has stated GLBA and HIPAA/HITECH routes.
Common questions
Is a paper record ever covered?
Yes. Section 715C.1(1) includes information transferred from computerized form to another medium, including paper.
Can the business decide there is no harm without a record?
No. Section 715C.2(6) requires the no-financial-harm determination to be documented in writing and kept five years.
Statutes and sources
- Iowa Code § 715C.1 — definitions.
- Iowa Code § 715C.2 — notices and exceptions.
Current official text accessed October 14, 2026.
Source links
Every statute quoted above, linked, with the date we checked it.
What does Iowa law mean for your facts?
You just read the general rule. Ask your own question and see which parts of current Iowa law apply to your situation, with citations you can check.
Try Ezel Pro free for 7 days. Cancel anytime before the trial ends and you pay nothing.
- Starts from the statutes this survey is built on
- Cites every source it relies on, so you can verify it
- Chat, drafting and research in one workspace