Iowa law imposes a duty upon businesses (and some other organizations and people) to notify individuals in the event that there is a breach. That requirement is contained in Iowa Code section 715C.2:
Iowa Business Security Breach Notification Requirements
by Attorney Eric D. Puryear