Iowa Consumer Data Protection (ICDPA)
The ICDPA is designed to protect consumer privacy and holds businesses accountable by mandating specific privacy requirements and by granting consumers a range of rights. In addition, the law prescribes penalties for non-compliance.
Is Complying with ICDPA Mandatory?
The ICDPA applies to businesses operating in Iowa or those targeting Iowa consumers that meet at least one of the following criteria:
They control or process the personal data of at least 100,000 consumers, or
They control or process the personal data of at least 25,000 consumers and derive over 50% of their gross revenue from the sale of personal data.
What are the penalties for not complying with ICDPA?
If you violate the ICDPA, you will be granted a 90-day cure period to amend your practices and rectify the violations. Failure to do so may result in civil penalties of up to $7,500 per violation.
Keep in mind, a violation of one consumer’s rights equates to one violation. If the rights of 100 consumers are violated, this amounts to 100 violations, potentially leading to a penalty of up to $750,000. Fines can accumulate rapidly.