1. Home
  2. State breach laws
  3. Iowa

Iowa data breach notification law

What Iowa requires when personal information is exposed: how fast residents must be notified, when the Attorney General has to be told, what it costs to get it wrong, and whether affected people can sue. Governed by Iowa Code ch. 715C (§§ 715C.1–715C.2).

No fixed deadline
Notification deadline
Required
AG notification
No
Private right of action
Affirmative defense
Liability protection

What this means if you sell security services

Iowa sets no fixed deadline, only "without unreasonable delay," so filings can land weeks after discovery, often after the organization has finished its first response and started asking what to do differently. Attorney General notice is required, and that filing is what puts the incident on the public record RiversideIQ tracks. The law itself gives individuals no right to sue, so the conversation centers on regulator penalties and remediation rather than lawsuits. Iowa also gives organizations with a qualifying security program an affirmative defense in breach lawsuits, a concrete state-law reason for a prospect to build and document one.

See recent Iowa breach filings →

Requirements in detail

Statute
Iowa Code ch. 715C (§§ 715C.1–715C.2)
Deadline to notify residents
In the most expeditious manner possible and without unreasonable delay after discovering the breach. Delays are allowed for a written law enforcement request and for steps needed to find contact information, determine the scope of the breach, and restore the security of the data.
Attorney General notification
Yes, if more than 500 Iowa residents must be notified, in writing to the director of the Consumer Protection Division of the Attorney General's office within five business days after notifying consumers. Iowa's law does not require notice to consumer reporting agencies.
Penalties
A violation is an unlawful practice under the Iowa Consumer Fraud Act (Iowa Code § 714.16), enforced by the Attorney General. Courts may grant injunctions and restitution and impose a civil penalty of up to $40,000 per violation, and the Attorney General may also recover damages on behalf of injured people.
Private right of action
No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.
Encryption exemption
Iowa's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.
Liability protection for security programs
Iowa (2023) gives businesses with a cybersecurity program conforming to a recognized framework an affirmative defense to tort claims alleging that a failure to implement reasonable security caused a breach. These protections limit lawsuits; they don't change the duty to notify. Iowa Code ch. 554G

Iowa breach notification FAQ

What is the data breach notification deadline in Iowa?

In the most expeditious manner possible and without unreasonable delay after discovering the breach. Delays are allowed for a written law enforcement request and for steps needed to find contact information, determine the scope of the breach, and restore the security of the data. The governing law is Iowa Code ch. 715C (§§ 715C.1–715C.2).

Does Iowa require notifying the Attorney General of a data breach?

Yes, if more than 500 Iowa residents must be notified, in writing to the director of the Consumer Protection Division of the Attorney General's office within five business days after notifying consumers. Iowa's law does not require notice to consumer reporting agencies.

What are the penalties for failing to report a data breach in Iowa?

A violation is an unlawful practice under the Iowa Consumer Fraud Act (Iowa Code § 714.16), enforced by the Attorney General. Courts may grant injunctions and restitution and impose a civil penalty of up to $40,000 per violation, and the Attorney General may also recover damages on behalf of injured people.

Can individuals sue over a data breach in Iowa?

No. The breach notification law itself doesn't give individuals a right to sue; the Attorney General enforces it. People can still bring other claims after a breach, such as negligence.

Does encrypted data need to be reported in Iowa?

Iowa's notification requirements apply to unencrypted personal information. Encrypted data generally doesn't trigger notice unless the encryption key or credentials were also compromised.

Does Iowa limit breach lawsuits for companies with a cybersecurity program?

Iowa (2023) gives businesses with a cybersecurity program conforming to a recognized framework an affirmative defense to tort claims alleging that a failure to implement reasonable security caused a breach. These protections limit lawsuits; they don't change the duty to notify.

Last reviewed October 5, 2026. This summary is for general information and is not legal advice. Statutes change; confirm current requirements with counsel or the Iowa Attorney General before relying on them.

Other states with a no fixed deadline

Breach notification laws by state

Compare all 51 jurisdictions on the interactive map →·US data breach statistics →