Iowa CDPA

Iowa Consumer Data Protection Act - controller obligations, consumer rights, sensitive data.


Short name	IA CDPA
Region	Americas
Country or scope	United States
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers IA CDPA

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 7 controls from Safeguard's control catalog for IA CDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 24: 2 written for IA CDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`IA-CDPA-SEC` Reasonable Data Security	Controllers must adopt and implement reasonable administrative, technical and physical safeguards appropriate to the volume and nature of the personal data at issue; integrity evidence for the processing software supports that duty (Iowa Code ch. 715D, controller-duties provision)	Scan
`IA-CDPA-INV` Processing System Accountability	Calibrating safeguards to the amount and nature of the data processed presumes the controller can enumerate the software systems that store or process consumer data (Iowa Code ch. 715D, controller-duties provision)	Scan
`IA-CDPA-PROC` Processor Contract Duties	Processing on a controller's behalf must be governed by a contract addressing instructions, confidentiality and subcontractor flow-down; naming the supplier behind each third-party component demonstrates that chain (Iowa Code ch. 715D, processor provisions)	Scan
`IA-CDPA-RIGHTS` Consumer Rights Response Readiness	Consumers may confirm processing, access and delete personal data, obtain a portable copy, and opt out of sale; responding within the statutory 90-day window requires the systems holding the data to be unambiguously identifiable (Iowa Code ch. 715D, consumer-rights provisions)	Scan
`IA-CDPA-NOTICE` Privacy Notice and Sensitive-Data Disclosure	Controllers must provide a reasonably accessible, clear privacy notice, including the notice-and-opt-out disclosure required before processing sensitive data; supporting documentation should carry document identity and a creation timestamp (Iowa Code ch. 715D, transparency provisions)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`IA-715D.2`	Consumer Rights: Access, Deletion & Portability
`IA-715D.3`	Opt-Out of Sale & Targeted Advertising
`IA-715D.4`	Sensitive Data: Opt-Out Model
`IA-715D.5`	Processor Agreements
`IA-715D.1`	Privacy Notice
`IA-715D.6`	Security Safeguards
`IA-715D.7`	Non-Discrimination

Policy templates

Written for IA CDPA:

Iowa CDPA State Privacy Notice
Iowa CDPA Consumer Rights Request Handling Procedure

And 22 from the standard set, adapted to IA CDPA.