Home›Obligations›United States›By state›Iowa

What a Iowa business has to have in writing

Iowa's standout written-policy requirement is its drug and alcohol testing statute: an employer may not test at all without first adopting a written policy and giving it to every employee.

Iowa also runs its own OSHA plan, has had a comprehensive consumer privacy law in force since January 2025, and requires insurance licensees with a workforce of 20 or more to certify a written security program each April. Construction contractors register with the Division of Labor at a low dollar threshold, and food establishments must keep a certified food protection manager.

Iowa has no state harassment training mandate, no pay transparency law and no paid leave statute, and no standalone biometric statute: biometric data is regulated only as sensitive data inside the consumer privacy law. State IT vendors face no Iowa cloud certification program.

Iowa has a rule of its own in 7 of the 14 areas, listed below. In 7 more we searched the state's own site and found nothing beyond the federal rule, but we have not finished writing up where we looked, so those are not shown yet.

Headcount

Industry General is always on

Ad from the publisher

Policy Acknowledgment Proof

IowaHandbook 2026acknowledged by name

Iowa on Recordwith AllyMatter

Cover Iowa the Modern WayEvery policy Iowa makes you write, acknowledged by name

Approve it, lock the version

Non-author approval, obsolete copies blocked

Every employee in Iowa on record

Who read which version, and when

Walk into any state inspection with the trail

From $29/mo, 20 editors, unlimited staff (published)

See how it works →Pricing →

Iowa rules for a 15–19 person general business

We check the same 14 areas of state law on every state page: breach notification, data security program, consumer privacy law, biometric and health data, harassment prevention, workplace safety programs, workplace violence prevention, insurance data security, state vendor security program, paid leave policies, required postings, pay transparency, licensing and certifications, and other written policies. Federal rules apply in most of these already. What this page adds is whether Iowa has a rule of its own on top. The federal rules every employer carries follow the Iowa rules. Each row names what you must write, post, file or certify, who enforces it, and links to the authority.

Breach Notification 1Who you must tell after a data breach, and how fast

LawProduceWhat it requiresTriggerEnforced by

Personal Information Security Breach ProtectionIowa Code ch. 715C #Any person who owns or licenses computerized personal information about Iowa residents, including paper records in some circumstancesDistribute

Notice

Write and send notice to affected Iowa consumers in the most expeditious manner possible and without unreasonable delay, no later than five business days after giving the required notice to the Attorney General; when more than 500 Iowa residents are affected, file a written report with the Attorney General's Consumer Protection Division within five business days of notifying consumers.

From the first employee

Iowa Attorney General, Consumer Protection Division

AuthorityIowa Attorney General - Security Breach Notifications Iowa Legislature - Iowa Code chapter 715C (PDF)Report an error

Consumer Privacy Law 1Rights, notices and assessments for consumer data

LawProduceWhat it requiresTriggerEnforced by

Iowa Consumer Data Protection ActIowa Code ch. 715D (Senate File 262, 2023) #Businesses operating in Iowa or targeting Iowa residents that, in a calendar year, control or process personal data of 100,000+ Iowa consumers, or 25,000+ consumers while getting more than half of gross revenue from selling personal dataWrite

Written policy

Publish a clear privacy notice covering the categories of personal data processed, the purposes, how consumers exercise their rights, what is shared and with whom, and whether personal data is sold; give consumers a way to opt out of data sales and targeted advertising; get consent or offer an opt-out before processing sensitive data; put required terms in processor contracts; and answer consumer access, deletion and portability requests within 90 days.

From the first employee

Iowa Attorney General (exclusive; 90-day cure period)

AuthorityIowa Legislature - Iowa Code chapter 715D (PDF)Iowa Attorney General - Consumer Protection Report an error

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

LawProduceWhat it requiresTriggerEnforced by

Iowa Occupational Safety and Health Act (Iowa OSHA State Plan)Iowa Code ch. 88; 875 Iowa Admin. Code #All private-sector and state and local government employers in IowaWrite

Written program

Follow the standards Iowa OSHA adopts, which mirror federal OSHA with Iowa-specific additions; post the Iowa OSHA safety and health poster, keep OSHA 300 injury and illness records where required, post the 300A summary annually, and report fatalities and serious hospitalizations. Written programs are required where the underlying standard calls for one, such as hazard communication, lockout/tagout and confined spaces.

From the first employee

Iowa OSHA, Iowa Division of Labor (Department of Inspections, Appeals, and Licensing)

AuthorityIowa Division of Labor - Iowa OSHA OSHA - Iowa State Plan Iowa Legislature - Iowa Code chapter 88 (PDF)Report an error

Required Postings 1The notices every workplace in the state must display

LawProduceWhat it requiresTriggerEnforced by

Required workplace postersIowa Code chs. 88 (safety), 91A (wage payment), 92 (child labor), 96 (unemployment), 85 (workers' compensation) #Every Iowa employerPost

Posting

Display the Division of Labor's required poster set, which covers Iowa OSHA, wage payment, child labor, unemployment insurance and workers' compensation, where employees can see it.

From the first employee

Iowa Division of Labor; Iowa Workforce Development

AuthorityIowa Division of Labor - Required Posters Iowa Department of Inspections, Appeals, and Licensing Report an error

Licensing and Certifications 2Registrations, licenses and certifications a business or its staff must hold

LawProduceWhat it requiresTriggerEnforced by

Business entity registration (Secretary of State)Iowa Code ch. 490 (corporations); ch. 489 (LLCs); ch. 547 (trade names) #Any corporation, LLC, LP, nonprofit or out-of-state entity doing business in IowaFile

Filing / record

File formation or foreign registration documents with the Secretary of State's Business Services division through Fast Track Filing, appoint an Iowa registered agent, and file the biennial report in the required year to stay in good standing.

From the first employee

Iowa Secretary of State, Business Services Division

AuthorityIowa Secretary of State - Business Services Iowa Secretary of State - Fast Track Filing Report an error

Sales and use tax permit and withholding registrationIowa Code ch. 423 (sales and use tax); ch. 422 (withholding) #Any business making taxable retail sales in Iowa or paying wages to Iowa employees, including remote sellers meeting the economic nexus thresholdFile

Filing / record

Register with the Department of Revenue for a sales tax permit and a withholding permit before doing business, display the permit at the business location, and file returns and remit tax on the assigned schedule.

From the first employee

Iowa Department of Revenue

AuthorityIowa Department of Revenue Iowa Department of Revenue - tax portal Report an error

Because You Are in Construction 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Construction contractor registrationIowa Code ch. 91C #Any contractor, in state or out of state, that earns at least $2,000 in a calendar year from construction work in IowaFile

Filing / record

Register with the Iowa Division of Labor before working, renew every year, carry unemployment insurance and workers' compensation coverage, and, for out-of-state contractors, post the required bond. The registration number must appear on bids and contracts.

From the first employee

Iowa Division of Labor, Contractor Registration

AuthorityIowa Division of Labor - Contractor Registration Iowa Legislature - Iowa Code chapter 91C (PDF)Report an error

Because You Are in Food & Beverage 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Food establishment license and certified food protection managerIowa Code ch. 137F; 481 Iowa Admin. Code chs. 30-31 #Restaurants, groceries, mobile food units, caterers and other food establishments; prepackaged-only sellers, temporary establishments and certain bars are exempt from the manager requirementCertify

Certification

Get a food establishment license before opening and renew it each year, pass inspections, and employ at least one certified food protection manager who passed an accredited exam; keep the certificate at the establishment and have a person in charge on duty during operating hours.

From the first employee

Iowa Department of Inspections, Appeals, and Licensing, Food and Consumer Safety; contracted local health departments

AuthorityIowa DIAL - Food Establishments and Hotels Iowa Legislature - Iowa Code chapter 137F (PDF)Iowa DIAL - Food Resources Report an error

Because You Are in Financial & Tax 1Industry layer

LawProduceWhat it requiresTriggerEnforced by

Insurance Data SecurityIowa Code ch. 507F #Insurance licensees regulated by the Iowa Insurance Division; licensees with a workforce under 20 people, under $5M gross annual revenue and under $10M in year-end assets are exempt, and HIPAA-covered licensees certify that insteadCertify

Certification

Build and keep a written information security program based on a risk assessment, with designated responsibility, third-party service provider oversight, a written incident response plan and annual reporting to the board; Iowa-domiciled insurers file the annual certification form with the Commissioner by April 15, and every licensee must notify the Commissioner of a cybersecurity event within three business days.

20+ employees

Iowa Insurance Division

AuthorityIowa Insurance Division - Data Security Act and Cybersecurity Events Iowa Legislature - Iowa Code chapter 507F (PDF)Iowa Legislature - Iowa Code § 507F.4 (PDF)Report an error

From the publisher

Keep Your Written Policies in One Place

Whatever you are working toward, AllyMatter gets your policies approved, keeps every version and records who has read each one.

See how AllyMatter works ↗From $29/mo, 20 editors, unlimited staff

Your business type, with Iowa on top

Need a hand implementing it?

Find a Consultant Who Does This Work

Tell us what you need done and we will point you to firms that do this work. Your details go to a firm only when you choose it.

Get help →Advertise Here

Sources

What a Iowa business has to have in writing

Headcount

Industry General is always on

Iowa rules for a 15–19 person general business

Breach Notification 1Who you must tell after a data breach, and how fast

Consumer Privacy Law 1Rights, notices and assessments for consumer data

Workplace Safety Programs 1Written programs the state safety agency requires beyond federal OSHA

Required Postings 1The notices every workplace in the state must display

Licensing and Certifications 2Registrations, licenses and certifications a business or its staff must hold

Other Written Policies 4Any other document the state makes an employer write or hand out

Because You Are in Construction 1Industry layer

Because You Are in Food & Beverage 1Industry layer

Because You Are in Financial & Tax 1Industry layer

Federal rules for a 15–19 person general business

Keep Your Written Policies in One Place

Your business type, with Iowa on top

For another state

Find a Consultant Who Does This Work

Sources

About this data

Think something is wrong?

Want to advertise here?