How long does a business have to respond to an Iowa privacy request?

Iowa is the outlier on timing. Where most states give you 45 days, Iowa gives 90, and the difference is large enough to change how you staff a request queue.

The 90-day clock

Section 715D.3(2)(a): a controller shall respond to the consumer without undue delay, but in all cases within ninety days of receipt of a request. The response period may be extended once by forty-five additional days when reasonably necessary upon considering the complexity and number of the consumer's requests, by informing the consumer of any such extension within the initial ninety-day response period, together with the reason for the extension.

So the outer limit is 135 days, and the extension carries the same conditions you see elsewhere: once only, reasonably necessary, and notified with a reason inside the original window.

For a business operating in several states, the practical point is that Iowa is the slack in the system, not the constraint. If you build one workflow to the strictest state you will meet Iowa comfortably. Building to Iowa and applying it everywhere is how you miss a Virginia or Delaware deadline.

Four rights, and correction is not one of them

Section 715D.3(1) requires a controller to comply with an authenticated consumer request to confirm whether the controller is processing the consumer's personal data and to access it; to delete personal data provided by the consumer; to obtain a copy of the consumer's personal data in a portable and, to the extent technically practicable, readily usable format where processing is automated; and to opt out of the sale of personal data.

That is the whole list. There is no right to correct inaccurate personal data, which nearly every other enacted state law includes.

Two further narrowings sit inside the list. The deletion right reaches personal data provided by the consumer, not data you obtained about them from other sources. And the portability right carves out personal data defined as "personal information" under section 715C.1 that is subject to security breach protection.

The opt-out is sale only

Paragraph (d) covers opting out of the sale of personal data. It does not cover targeted advertising, and it does not cover profiling.

This is the single biggest divergence from the Virginia model that most of the other states follow, where the opt-out routinely spans sale, targeted advertising, and profiling in furtherance of significant decisions. If you built your opt-out to the Virginia pattern you are already ahead of what Iowa requires, but you should not assume the reverse.

Declining, and the fraud exception

Under 715D.3(2)(b), if a controller declines to act it must inform the consumer without undue delay of the justification, except in the case of a suspected fraudulent request, where the controller may simply state that it was unable to authenticate the request. The controller must also provide instructions for appealing.

That fraud carve-out is a sensible piece of drafting: it lets you refuse a suspicious request without explaining to a possible attacker exactly what tripped your checks.

Appeals get 60 days and a mandatory route to the regulator

Section 715D.3(3) requires an appeal process, conspicuously available and similar to the process for submitting requests. Within 60 days of receipt of an appeal the controller must inform the consumer in writing of any action taken or not taken, including a written explanation of the reasons.

If the appeal is denied, the controller shall also provide the consumer with an online mechanism through which the consumer may contact the attorney general to submit a complaint. Note what is missing: Delaware and Virginia both soften this with "if available" or an alternative method. Iowa does not. The online mechanism is the requirement.

Cost

Under 715D.3(2)(c), responses are free up to twice annually per consumer. Where a request is manifestly unfounded, excessive, repetitive, technically unfeasible, or the controller reasonably believes its primary purpose is not to exercise a consumer right, the controller may charge a reasonable administrative fee or decline. The controller bears the burden of demonstrating that character.

Iowa's list of grounds is wider than most, adding "technically unfeasible" and the primary-purpose test, but the burden still sits with you.

Next step

Iowa's combination of a long clock and a short rights list makes it easy to over-build or under-build against. The free 2-minute Obligation Scan tells you which US state privacy laws apply to your business and what each actually requires. See the Iowa consumer data protection overview for the applicability thresholds, and compare the Delaware and Virginia deadlines, both of which run on 45 days.