A bill for an act relating to personal data processing practices for companies, and making civil penalties applicable.

HF 2048 requires companies processing personal data for 5,000+ Iowa residents annually to obtain clear consent before using data, disclose how data will be used (including for automated decisions), and limit collection to what’s necessary. It grants Iowa residents the right to access, correct, delete their data, and revoke consent at any time. Companies must implement security measures to protect data and face civil penalties of up to $7,500 per violation for breaches or noncompliance. The bill applies to commercial data processing but exempts law enforcement, de-identified data, and public information.