ShareAndGoShareAndGo

Data breach notification

Iowa data breach notification law

Iowa's breach notice duty sits in Iowa Code section 715C.2, with its definitions in section 715C.1.

Who must be told, and when

Iowa asks for consumer notification in the most expeditious manner possible and without unreasonable delay. There is no fixed count of days for consumers.

A second clock runs for the state. When a breach requires notice to more than five hundred Iowa residents, written notice goes to the director of the consumer protection division of the office of the attorney general within five business days after notice is given to any consumer.

Note the trigger: the five business days start from the first consumer notice, not from discovery.

The Iowa definition

Personal information begins with a first name or first initial and last name, then adds any of: a Social Security number; a driver's license or other government ID number; a financial account or card number with any required expiry date, code or password; a unique electronic identifier or routing code with any required code or password; or unique biometric data.

Biometric data is described as a fingerprint, retina or iris image, or other unique physical or digital representation of biometric data. Iowa's definition also reaches paper copies made from computerized data.

Encryption and the no-harm exception

Data is in scope when it is not encrypted, redacted, or otherwise altered so that it is unreadable, or when it was protected but the keys to read it were obtained through the breach.

Notification is not required if, after an appropriate investigation or after consultation with law enforcement agencies, the business determined that no reasonable likelihood of financial harm to the affected consumers has resulted or will result. That determination has to be put in writing and kept for five years.

Where ShareAndGo fits

After an incident in a data room, a clean timeline is what lets you size the problem.

For documents you share through ShareAndGo, the activity log records every view and download, and watermarked view-only pages carry the reader's email address and the date.

The watermark is on by default and can be set room by room. Every entry in the chained log also covers uploads, invitations and changes, and the whole trail exports as CSV. Recipients prove their address with a six-digit code and need no account, while groups only ever see their own folders, which keeps the set of possible readers for any file easy to state.

Iowa questions

Who in Iowa government receives the notice?
The director of the consumer protection division of the office of the attorney general, when more than five hundred Iowa residents are notified.
How long is the window for that notice?
Five business days after notice is given to any consumer.
Can a business skip notice if no harm is likely?
Yes, if after an appropriate investigation or consultation with law enforcement it determines there is no reasonable likelihood of financial harm, and that determination is documented in writing and kept five years.
Are paper records covered?
Paper copies made from computerized data are within Iowa's definition.

Review date

Checked against Iowa's published law on November 2, 2026. This is general information, not legal advice.

Related pages

Breach notification laws by state

Breach notice rules for every jurisdiction.

ShareAndGo vs DataRooms.com

Compare data rooms on audit logs and protection.

ShareAndGo

Start at the ShareAndGo home page.