Iowa SaaS Agreement Review
Iowa's Consumer Data Protection Act, Iowa Code Chapter 715D, took effect January 1, 2025. It is one of the more business-friendly state privacy laws, with a 90 day cure period and no private right of action, but it still requires a written contract between a controller and each processor. A Des Moines or Cedar Rapids business that buys SaaS and meets the thresholds needs those terms in its vendor paperwork.
Consumer privacy law in Iowa
Iowa Consumer Data Protection Act (ICDPA)
Data rights in Iowa
Iowa has enacted the Iowa Consumer Data Protection Act (ICDPA), a comprehensive consumer privacy law. It gives residents rights over their personal data, typically access, correction, deletion, and the ability to opt out of the sale of data and targeted advertising, and generally requires vendors to sign a data-processing agreement. When you buy SaaS that will hold data about Iowa residents, the vendor's terms should line up with those obligations.
The clauses that decide your risk
- Data use & AI training, is your data used only to provide the service, or to "improve" (train) the vendor’s models?
- Liability cap, often just one month of fees, against real data-loss exposure
- Auto-renewal, the cancellation-notice window (miss it and you renew for a year)
- Price increases, capped, or unilateral at renewal?
- Data export & deletion on termination, can you get your data out, and is it deleted?
- Uptime SLA and service credits
What must an Iowa processor contract include?
Iowa Code 715D.5 requires a contract that sets out processing instructions, the nature and purpose of processing, the type of data, the duration, and both parties' rights and duties. The processor must bind its staff to confidentiality, delete or return data at the controller's direction when services end, provide information showing compliance, and use subcontractors only under written contracts with the same duties.
The Act applies to businesses that control or process data of at least 100,000 Iowa consumers a year, or at least 25,000 while earning more than 50% of gross revenue from selling personal data.
Enforcement and breach notice
Only the Attorney General enforces the Act. Before suing, it must give 90 days' written notice and a chance to cure. Uncured violations carry civil penalties up to $7,500 each. Separately, Iowa Code 715C requires breach notice to consumers without unreasonable delay, and notice to the Attorney General within five business days after notifying consumers when more than 500 Iowans are affected.
When can an Iowa business skip breach notice?
Notice is not required if, after an appropriate investigation or consultation with law enforcement, the business finds no reasonable likelihood of financial harm. That determination must be documented in writing and kept for five years. Iowa's breach law also covers paper records that came from computerized data, and substitute notice is allowed above $250,000 in costs or 350,000 people.
Iowa sources checked 2026-10-09: Iowa Code Chapter 715D (Iowa Legislature) · Ashurst Perkins Coie, Iowa breach chart. Laws change; confirm the current rule before relying on it.
Iowa SaaS agreement FAQ
Does Iowa have a data privacy law that affects SaaS contracts?
Yes. Iowa has enacted a comprehensive consumer privacy law, the Iowa Consumer Data Protection Act (ICDPA). It gives residents rights over their personal data (such as access, deletion, and opting out of sale or targeted advertising) and generally requires a data-processing agreement, which shapes what a SaaS vendor can do with data about Iowa residents.
Can a SaaS vendor use my Iowa business's data to train AI?
Only if the contract lets them. Many SaaS agreements grant the vendor a right to use "customer data" to "improve the services," which can extend to training models. Regardless of Iowa law, insist the contract says your data is never used to train shared or general-purpose models and is processed only to provide the service to you.
What should I check before signing a SaaS agreement in Iowa?
The clauses that decide your risk: how your data can be used (and whether it trains AI), the liability cap versus your data-loss exposure, auto-renewal and the cancellation-notice window, unilateral price increases, and whether you can export and require deletion of your data on termination. ClauseAudit flags each against Iowa law in about a minute.
Does Iowa's privacy law let local governments set stricter rules for SaaS?
No. Iowa Code 715D.9 preempts city, county and other local rules on the processing of personal data by controllers and processors. A business operating across several Iowa cities only needs to meet the single state standard plus its contract terms, not a patchwork of local ordinances.
Does Iowa's breach law cover biometric logins?
Yes. Iowa's definition of personal information includes unique biometric data, such as fingerprints or retina scans, alongside Social Security numbers and financial account data. If your SaaS tool uses biometric authentication, ask how templates are stored and make sure the vendor's breach reporting covers that data.
Reviewing a SaaS contract in Iowa?
Upload it and get the data, liability, and renewal terms checked against Iowa law in about a minute.
State privacy-law status summarized as of October 2026; this area changes quickly and thresholds and effective dates vary. This is automated educational information, not legal advice, ClauseAudit verifies current Iowa law when you run your agreement, and you should confirm anything critical with a qualified attorney.