language: en · status: in-force · last checked: 2026-10-08

Iowa — personal information security breach protection (Iowa Code ch. 715C)

Iowa Code chapter 715C, enacted by 2008 Acts, ch 1154 (S.F. 2308, approved 10 May 2008, which specifies no effective date, so under Iowa Code §3.7(1) it took effect on 1 July 2008) and last amended by 2018 Acts, ch 1091, is Iowa's data-breach notification law. It applies to any "person", a term that includes governments and their subdivisions and agencies as well as businesses, so it reaches both a school district that owns student data and a vendor that holds data on the district's behalf.

Applicability to EdTech

• Vendors notify the data owner. "Any person who maintains or otherwise possesses personal information on behalf of another person shall notify the owner or licensor of the information of any breach of security immediately following discovery" (§715C.2(2)). A hosted service holding a district's data is that person; the district, as owner or licensor, then notifies consumers (§715C.2(1)).
• Biometrics are personal information. The definition includes "Unique biometric data, such as a fingerprint, retina or iris image, or other unique physical representation or digital representation of biometric data" when combined with a name (§715C.1(11)(a)(5)).
• "Breach of security" covers unauthorized acquisition of computerized personal information, and paper transferred from computerized form (§715C.1(1)); encrypted data is outside the definition unless the keys were also obtained (§715C.1(11)(a)).
• Content and method of notice are prescribed (§715C.2(4)–(5)); a documented risk-of-harm determination, kept for five years, can excuse notice (§715C.2(6)); notice to the Attorney General's consumer protection division is due within five business days when more than 500 Iowa residents are notified (§715C.2(8)).

Contents

Key obligations at a glance

• Holding data for another: notify the owner or licensor immediately on discovering a breach — §715C.2(2).
• Owning or licensing data: notify affected consumers in the most expeditious manner possible and without unreasonable delay — §715C.2(1).
• Notify the Attorney General within five business days where more than 500 residents are notified — §715C.2(8).

Enforcement

A violation is an unlawful practice under section 714.16 (the consumer fraud act), and the Attorney General may also obtain an order to pay damages on behalf of injured persons (§715C.2(9)).

Licence

The corpus reproduces Iowa Code §§715C.1 and 715C.2 verbatim from the Iowa Legislature's 2026 Code PDFs.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The Iowa General Assembly's disclaimer (legis.iowa.gov/law/disclaimer, read 2026-10-08) states no copyright or licence terms for the Code; it says: "This website contains official editions of legal publications produced as copies in a PDF format." The only rights reservation on that page concerns session photographs owned by the Associated Press, which the corpus does not reproduce. The Acts credits and "Referred to in" notes are the Legislative Services Agency's, made in the course of its legislative duties.

Conditions: none attach. The corpus names the official source in Sources and in each section's {.meta} provenance line, and its Meta section describes what it changed (anchors added, a backslash before a list designation's period so Markdown does not renumber it, nothing reworded).

Related

• Iowa — student online personal information protection (Iowa Code §279.71) — the operator duties whose security failures this chapter's notification rules then govern
• Kentucky personal information security (KRS 61.931–61.933) — a breach regime that names a school district's suppliers expressly

Sources

• Iowa Legislature — Iowa Code 2026, §715C.1 (PDF)
• Iowa Legislature — Iowa Code 2026, §715C.2 (PDF)
• Iowa Legislature — 2008 Iowa Acts, chapter 1154 (S.F. 2308) (PDF) — the enacting Act: sections 1 and 2 add §§715C.1 and 715C.2, no section sets an effective date, "Approved May 10, 2008"
• Iowa Legislature — Iowa Code 2026, §3.7 (PDF) — "All Acts and resolutions of a public nature passed at regular sessions of the general assembly shall take effect on the first day of July following their passage, unless some other specified time is provided"; last amended by 2006 Acts, ch 1010, so the rule applied in 2008