Iowa Data Breach Notification Law

The Iowa data breach notification law covers volunteer work too

Chapter 715C reaches anyone who owns or licenses computerized personal information used in a business, a job or a volunteer activity ¹. A booster club's roster is in scope as much as a firm's client list, and files printed out or copied to other media from a computer still count.

Timing is "most expeditious manner possible and without unreasonable delay," with allowance for police requests, finding contact details, sizing up the breach and restoring the data ¹.

Biometric data, other government-issued ID numbers, and an electronic identifier or routing code with its access code are protected alongside the familiar identifiers ¹.

Telling the Attorney General's office after residents

Here the state hears after the residents. Past 500 Iowans, written notice goes to the director of the Attorney General's consumer protection division within five business days of the consumer mailing ¹. Put that date on the mailing plan and keep proof of when it went.

The credit bureaus get no notice, but the resident letter has to list their contact details so people can act on their own ¹.

Outside firms holding a client's data must tell that client immediately after discovering a breach ¹.

The financial harm test and the five-year record

An appropriate investigation, or a consultation with police, that finds no reasonable likelihood of financial harm removes the duty to notify ¹. That finding must be written down and kept five years ¹. The test is about money only; other kinds of harm do not enter into it.

Encrypted, redacted or otherwise unreadable data is outside the law unless the breach also yielded the keys ¹. Volunteer groups often keep member lists on personal laptops and home computers, so switching on device encryption there is the cheapest way to keep a lost machine from becoming a mailing.

Where the exposed data is something like biometric records, the financial harm question can be close. Those are the decisions to document most carefully and to run past counsel before you rely on them.

Entities following GLBA, HIPAA or a federal regulator's equal-or-stronger rules are exempt ¹; a HIPAA-covered clinic works from the federal patient notice rule.

Attorney General enforcement and your response plan

Violations are unlawful practices under Iowa Code section 714.16; the Attorney General enforces them and can also recover damages for injured people ¹. The chapter calls its remedies cumulative without saying yes or no to private suits.

When the attack is still going, an insured Iowa organization phones its carrier first, submits an FBI complaint at ic3.gov, and leaves systems unwiped until the evidence is copied ²⁴³. Confirm which law firms the carrier approves before engaging one; what carriers put in their policies explains the usual terms.

Your IT support, or a forensic firm for a serious incident, then contains it along the lines of our breach response steps. Record each person's state: a worker living in Illinois or a customer in Minnesota brings that state's law in, and every state's rule is in our comparison table.

Chapter 715C was rechecked for this page on October 13, 2026. Whether the harm in your incident counts as financial calls for legal advice from an Iowa lawyer, not a general guide.