Highlights

Covered Entities: Persons or businesses who own or license computerized data that includes personal information concerning a Utah resident.

Consumer Notification: Notification must be provided to any Utah resident whose unencrypted or unprotected personal information has been acquired without authorization where it is likely that personal information has been or will be misused for identity theft or fraud purposes.

Regulatory Notification: Notification must be provided to the Attorney General and Utah Cyber Center where the misuse of personal information relating to 500 or more Utah residents for identity theft or fraud has occurred or is reasonably likely to occur.

Notification Timeline: Notification must be provided “in the most expedient time possible without unreasonable delay…”

Data Format: Electronic.

Citations: Utah Code §§ 13-44-101-103, § 13-44-202, § 13-44-301

More Details

Definitions:

• Breach: Unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of personal information.
• Personal Information (PI): An individual’s first name or first initial and last name, combined with any one or more of the following data elements relating to that person when either the name or data element is unencrypted or not protected by another method that renders the data unreasonable or unusable:
  • Social Security number;
  • Driver’s license number or state identification number; or
  • Financial account number, or credit or debit card number, in combination with any required security code, access code, or password that would permit access to the person’s account.
  • PI does not include information contained in federal, state, or local government records or in widely distributed media that are lawfully made available to the general public.
• Medical Information: N/A
• Health Insurance Information: N/A

Safe Harbors:

• Encryption: Notification is not required where the potentially impacted PI was encrypted or protected by another method that renders the data unreadable or unusable.
• Good Faith: Notification is not required where the potentially impacted PI was acquired in good faith by an employee or agent, unless the PI is used for an unlawful purpose or disclosed in an unauthorized manner.
• Risk of Harm: Notification is not required if after a reasonable and prompt investigation, the entity determines that it is unlikely that PI has been or will be misused for identity theft or fraud purposes.
• Law Enforcement Delay: Notification may be delayed if a law enforcement agency determines that the notification will impede a criminal investigation.
• Public Record: N/A

Direct Notice:

• Timing: Notification must be provided in the most expedient time possible without unreasonable delay, consistent with measures necessary to determine the scope of the breach and restore the reasonable integrity of the system.
• Format: N/A
• Content: N/A
• Method: Notification may be provided in the following ways: (1) in writing by first-class mail to the most recent address the person has for the resident; (2) electronically, if the person’s primary method of communication with the resident is by electronic means, or if provided in accordance with the consumer disclosure provisions of 15 U.S.C. Section 7001; or (3) by telephone, including through the use of automatic dialing technology not prohibited by other law.

Substitute Notice:

Substitute notice may be providede if the above notification methods are not feasible for residents of the state, by publishing notice of the breach in a newspaper of general circulation and as required in Section 45-1-101 (setting forth legal notice publication requirements).

Remediation Services:

N/A

Regulatory Notice:

Notification must be provided to the Attorney General and Utah Cyber Center where the misuse of PI relating to 500 or more Utah residents for identity theft or fraud has occurred or is reasonably likely to occur. Specific regulatory notice content requirements are set forth by statute.

Credit Reporting Agencies Notice:

Notification must be provided where the misuse of PI relating to 1000 or more Utah residents for identity theft or fraud has occurred or is reasonably likely to occur. This notice must include timing, distribution, and content of the consumer notice.

Third-Party Notice:

A person who maintains computerized data that includes PI that the person does not own or license must notify and cooperate with the owner or licensee of the PI of any breach of system security immediately following the person's discovery of the breach if misuse of the PI occurs or is reasonably likely to occur. This includes sharing information relevant to the breach with the owner or licensee of the information.

HIPAA:

A person who is regulated by state or federal law and maintains procedures for a breach of system security under applicable law established by the primary state or federal regulator is considered to be in compliance with this part of the person notified each affected Utah resident in accordance with other applicable law in the event of a breach.

Private Action:

None. Only the Utah Attorney General may enforce violations. Violators are subject to a civil penalty of:

• No greater than $2,500 for a violation or series of violations concerning a specific consumer; and
• No greater than $100,000 in the aggregate for related violations concerning more than one consumer unless (i) the violations concern 10,000 or more consumers who are residents of the state; and 10,000 or more consumers who are residents of other states; or (ii) the person or entity agrees to settle for a greater amount.

The attorney general may also seek injunctive relief to prevent future violations and attorneys’ fees and costs.

Associated Regulations:

• Utah Information Security Standard (Utah Code §§ 13-44-201)
• Utah Genetic Information Privacy Act (Utah Code §§ 13-60-101-207)
• Utah Consumer Privacy Act (Utah Code §§ 13-61-101-404)

Utah Consumer Privacy Act (UCPA)

Utah Code Annotated, §§ 13-2-1 and 13-61-101 to13-61-404

Effective January 1, 2027, Utah Code Ann. § § 13-61-501 to 13-61-504, enacted by H.B. 357, “Amendments to Motor Vehicle Data Privacy.”

Highlights

Applicability:

Controllers or Processors that conduct business in Utah or produce or deliver commercial products or services intentionally targeted to Utah residents and that:

• Exceed $25,000,000 in annual revenue; and
• During a calendar year, control or process Personal Data of 100,000 consumers or more; or
• Control or process Personal Data of 25,000 or more consumers and derive more than 50% of gross revenue from Personal Data sales.

UCPA excludes from its scope certain entities, such as governmental entities or third parties contracted by and acting on behalf of the governmental entity, tribes, financial institutions subject to Title V of the GLBA, covered entities and business associates as defined under HIPAA, non-profits, and institutions of higher education. The UCPA also excludes air carriers and, except as otherwise provided in the statute, personal data processed or maintained in the course of an individual applying to, being employed by, or acting as an agent or independent contractor of a controller, processor, or third party; emergency-contact information; and data necessary to administer employment benefits. In addition, the Act excludes from its scope certain types of information such as information protected by HIPAA, patient identifying information, personal data processed for purpose of certain types of research, information regulated by Health Care Quality Improvement Act of 1986,  patient safety work product under the Patient Safety and Quality Improvement Act, by the Fair Credit Reporting Act, Drivers Privacy Protection Act, Family Educational Rights and Privacy Act, Farm Credit Act, as well as employment-related data. [2026 UPDATE: The statute also excludes information originating from, and intermingled to be indistinguishable with, exempt HIPAA or health-related information that is maintained by a covered entity or business associate; information included in a limited data set under 45 C.F.R. § 164.514(e); information used for public-health activities and purposes authorized by HIPAA; and personal data regulated by the Airline Deregulation Act to the extent the UCPA is preempted by that Act.

Controller and Processor Obligations

Controllers: UCPA Controller duties include obligations to:

• Provide consumers with a reasonably accessible and clear privacy notice that describes among others the categories of Personal Data processed by the Controller, the purpose for the categories of Personal Data are processed, how consumers may exercise a right, the categories of Personal Data that the Controller shares with third parties, if any, and the categories of third parties, if any, with whom the Controller shares Personal Data.
• If the Controller sells consumer’s Personal Data or engages in targeted advertising, it shall clearly and conspicuously disclose the manner in which a consumer may exercise the right to opt out of the sale of Personal Data or the processing of Personal Data for targeted advertising.
• Establish, implement and maintain reasonable administrative, technical and physical data security procedures and practices commensurate with the nature of the Personal Data so as to protect the confidentiality, integrity and accessibility of Personal Data and reduce reasonably foreseeable risks of harm to consumers related to the processing of Personal Data.
• Refrain from processing Sensitive Personal Data without presenting the consumer with a clear notice and an opportunity to opt out of the processing, or if processing data of a known child processing the data in accordance with the federal Child Online Privacy Protection Act (COPPA).
• Not discriminate against a consumer for exercising consumer rights. However, controllers may offer incentives for voluntary participation in promotions. A Controller may not discriminate against a consumer for exercising a right by denying a good or service, charging a different price or rate, or providing a different level of quality. This restriction does not prohibit a Controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including a good or service offered for no fee, if the consumer has exercised the right to opt out or if the offer is related to the consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. 
• Comply with consumer requests in a timely and efficient manner and not discriminate against consumers who exercise such rights. Current consumer rights include the rights to confirm processing, access Personal Data, delete Personal Data provided by the consumer, obtain a portable copy of Personal Data previously provided by the consumer, and opt out of the sale of Personal Data or processing for targeted advertising.
• Effective July 1, 2026, consumers will also have the right to request that a Controller correct inaccuracies in the consumer’s Personal Data, taking into account the nature of the Personal Data and the purposes of processing.
• Establish contractual arrangements with processors and third parties clearly outlining their roles and responsibilities, including: instructions for processing Personal Data, the nature and purpose of the processing, the type of data subject to processing, the duration of the processing, and the parties' rights and obligations. The contract must also require the Processor to ensure that each person processing Personal Data is subject to a duty of confidentiality and to engage any subcontractor pursuant to a written contract requiring the subcontractor to meet the same obligations as the Processor with respect to the Personal Data.

Processors: UCPA Processor duties include obligations to:

1. Adhere to the Controller’s instructions.
2. Assist the Controller in meeting their obligations related to security of processing of Personal Data and breach notification.
3. Before processing any Personal Data enter a contractual agreement that clearly outlines the obligations of the processor, duties of confidentiality, instructions for the processing of data, and requirements for sub-processing of data.

Consumer Rights:

A Controller must respond without undue delay and within forty-five (45) days (with a 45-day extension if reasonably necessary) to verified consumer requests regarding the processing of Personal Data and Sensitive Personal Data, including consumers’:

• Right to know and access Personal Data;
• Effective July 1, 2026, right to correct inaccurate Personal Data;
• Effective July 1, 2026, right to request that a Controller correct inaccuracies in the consumer’s Personal Data, taking into account the nature of the Personal Data and the purposes of the processing of the consumer’s Personal Data;
• Right to request deletion of Personal Data that the consumer provided to the controller;
• Right to obtain Personal Data that the consumer provided to the controller in a format that is generally portable, readily usable, and transmittable;
  • Effective July 1, 2026, the Utah Digital Choice Act increases content, interoperability, and other requirements for social media company responses to consumer data portability requests.
• Effective July 1, 2026, the Utah Digital Choice Act adds social-media-specific data portability requirements. If a consumer requests a copy of the consumer’s Personal Data under Utah Code Ann. § 13-61-201, a social media service must provide the Personal Data, including the user’s social graph, in a format that is portable to the extent technically feasible, readily usable to the extent practicable, and allows the consumer to transmit the data to another Controller without impediment if the Controller processes the data by automated means.
• Right to opt out of Personal Data sales and targeting advertising.
• Right to non-discrimination for exercising their consumer rights.
• A consumer may exercise a right by submitting a request to the Controller, by means prescribed by the Controller, specifying the right the consumer intends to exercise. For Personal Data concerning a known child, the parent or legal guardian exercises the right on the child’s behalf. For a consumer subject to guardianship, conservatorship, or another protective arrangement, the guardian or conservator exercises the right on the consumer’s behalf.

If a Controller chooses not to take action on consumer's request, the controller shall within 45 days after the day on which the controller receives the request, inform the consumer of the reasons for not taking action. A Controller may extend the initial 45-day response period once by an additional 45 days if reasonably necessary due to the complexity of the request or the volume of requests received, but must inform the consumer of the extension, the length of the extension, and the reasons the extension is reasonably necessary before the initial 45-day period expires. The 45-day period does not apply if the Controller reasonably suspects the request is fraudulent and cannot authenticate the request before the period expires.

A Controller may not charge a fee for information in response to a request unless the request is the consumer’s second or subsequent request during the same 12-month period. For a second or subsequent request, the Controller may charge a reasonable fee based on administrative costs, or may decline to act, if the request is excessive, repetitive, technically infeasible, or manifestly unfounded. The Controller bears the burden of demonstrating those grounds.

More Details

Definitions:

• Authenticate: To use reasonable means to determine that a consumer’s request to exercise the rights described in Section 13-61-201 is made by the consumer who is entitled to exercise those rights.
• Biometric Data: Data generated by automatic measurements of an individual’s unique biological characteristics, including an individual’s fingerprint, voiceprint, eye retinas, irises, or any other unique biological pattern or characteristic that is used to identify a specific individual. Biometric data does not include a physical or digital photograph; a video or audio recording; data generated from a photograph, video, or audio recording; information captured from a patient in a health care setting; or information collected, used, or stored for treatment, payment, or health care operations as defined under HIPAA regulations.
• Child: An individual younger than 13 years old. Utah Code Ann.
• Consumer: An individual who is a Utah resident acting only in a personal or household context; this definition does not include individuals acting as a job applicant or beneficiary of someone in an employment context.
• Controller: A person doing business in Utah, who alone or jointly with others, determines the purposes and means for processing Personal Data.
• Deidentified Data: Data that cannot reasonably be linked to an identified individual or an identifiable individual and that are possessed by a Controller who takes reasonable measures to ensure that a person cannot associate the data with an individual, publicly commits to maintain and use the data only in deidentified form and not attempt to reidentify the data, and contractually obligates recipients of the data to comply with the same requirements. Deidentified data includes synthetic data.
• Personal Data: Information linked to or reasonably linkable to an identified or identifiable individual. Personal Data excludes de-identified or aggregate data and publicly available information (defined as information lawfully made available through governmental records, information that a Controller has a reasonable basis to believe the consumer has lawfully made available to the general public, and data the Controller obtains from a person to who, he consumer has disclosed the data without restricting it a specific audience.
• Processor: A person who processes Personal Data on behalf of a Controller.
• Pseudonymous Data: Personal Data that cannot be attributed to a specific individual without the use of additional information, if the additional information is kept separate from the consumer’s Personal Data and subject to appropriate technical and organizational measures to ensure that the Personal Data are not attributable to an identified individual or identifiable individual.
• Sale of Personal Data: The exchange of Personal Data for monetary consideration by the Controller to a third party.  The sale excludes the following disclosures from this definition: (i) disclosure to a processor for processing on behalf of the Controller; (ii) disclosures to an affiliate of the Controller;  (iii) disclosures to a third party if the purpose is consistent with the consumer’s reasonable expectation; (iv) disclosures made by the Controller upon consumers direction or when they interact with third parties; (v) a consumer’s disclosure of Personal Data to a third party for purposes of providing a product or service requested; (vi) disclosures that the consumer makes to the general public or does not restrict to specific audience; (vii) a  disclosure or transfer as an asset in a merger or other transaction in which the third party assumes control of all or part of the Controller’s assets.
• Sensitive Personal Data: Personal Data revealing:  racial or ethnic origin, religious beliefs, medical history, mental/physical health condition or diagnosis, sexual orientation, or citizenship/immigration status; genetic and biometric data; and specific geolocation data. Sensitive Data excludes Personal Data that reveals racial or ethnic origin if the data is processed by video communications information regarding an individual’s medical history, mental or physical health condition, or medical treatment or diagnosis by a health care professional if processed by a person licensed to provide health care under Title 26B, Chapter 2, Part 2, Health Care Facility Licensing and Inspection, or Title 58, Occupations and Professions.
• Specific Geolocation Data: Information derived from technology, including global positioning system level latitude and longitude coordinates, that directly identifies an individual’s specific location, accurate within a radius of 1,750 feet or less. Specific geolocation data does not include the content of a communication or data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.
• Targeted Advertising: Displaying to a consumer advertisement based on Personal Data obtained from consumer’s activities over time and across nonaffiliated websites and applications to predict their interests or preferences.  Excludes:  (i) advertisement based on activities within the Controllers websites/applications or any affiliated websites/applications; (ii) advertisement based on the context of consumers current search query or visit to a website/application; (iii) advertisement directed to the consumer in response to their request; or (iv) Personal Data processed solely for measuring or reporting advertisement performance, reach, or frequency.
• Third Party: A person other than the consumer, Controller, Processor, or an affiliate or contractor of the Controller or Processor. Trade Secret: Information, including a formula, pattern, compilation, program, device, method, technique, or process, that derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from the information’s disclosure or use, and that is the subject of reasonable efforts to maintain secrecy.
• Social Graph: Effective July 1, 2026, Data that represents a person’s connections and interactions within a social media service, including social connections, content created by the person, responses to other users’ content, other users’ response to the person’s content, and related metadata.
• Social Media Company: Effective July 1, 2026, an entity that owns or operates a social media service.
• Social Media Service: Effective July 1, 2026, A public website or application that allows a person to create an account for use by the person, enables the person to create a public profile, and allows the person to upload posts or content and view posts or content generated by other users in the user’s network. The term does not include an email service; a cloud storage service; or a document viewing, sharing, or collaboration service.

Penalties:

The Attorney General has the authority to enforce this Act, and provided that the Controller or Processor has failed to cure a violation within 30 days, the Attorney General may initiate action to recover actual damages to the consumer or seek penalty not exceeding $7,500 per violation.

Private Action:  

No

Associated Regulations:

The Utah Cybersecurity Affirmative Defense Act; Utah Code § 78B-4-701-06. 

Notes on AI Related Rulemaking:

The UCPA is not a standalone AI law. Unlike several other state privacy laws, the UCPA does not provide a general consumer right to opt out of profiling and does not require data protection assessments for high-risk profiling. Its AI-adjacent relevance is primarily through sensitive data, targeted advertising, data minimization, security obligations, and consumer rights related to access, deletion, portability, and opt out of sale or targeted advertising.

Effective Date:

December 31, 2023; Utah Code Ann. § § 13-61-501 to 13-61-504: January 1, 2027

Highlights

Covered Entities: Any person who conducts business in the state of Utah and maintains personal information.

First-Party Security Standard: Any person who conducts business in Utah and maintains personal information shall implement and maintain reasonable procedures to:

• Prevent unlawful use or disclosure of personal information collected or maintained in the regular course of business; and
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained by the person.

Third-Party Security Standard: N/A

Disposal/Destruction Standard: The destruction of records shall be by shredding, erasing, or otherwise modifying the personal information to make the information indecipherable.

Data Format: Electronic and Paper.

Citations: Utah Code §§ 13-44-101–301

More Details

Definitions:

Personal Information (PI): An individual’s first name / first initial and last name in combination with one (1) or more of the following data elements when either the name or data element is unencrypted or not protected by another method that renders the data unreadable or unusable: 

• Social Security number;
• Driver’s license number or state identification card number; or
• Financial account number, or credit or debit card number, and any required security code, access code, or password that would permit access to the person's account.

PI does not include information regardless of its source, contained in federal, state, or local government records or in widely distributed media that are lawfully made available to the general public.

Breach of System Security: An unauthorized acquisition of computerized data maintained by a person that compromises the security, confidentiality, or integrity of PI. The term does not include the acquisition of PI by an employee or agent of the person possessing unencrypted computerized data unless the PI is used for an unlawful purpose or disclosed in an unauthorized manner.

Methods of Compliance:

The statute does not define what constitutes reasonable security procedures and practices.

Exclusions:

• Health Care: N/A
• Financial: These requirements do not apply to a financial institution or an affiliate, as defined in 15 U.S.C. § 6809, of a financial institution.
• Other: N/A

Enforcement/Penalties:

The Attorney General may enforce Utah’s Protection of Personal Information Act (the “Act”), set forth in Title 13, Chapter 44 of the Utah Code. A person who violates the Act’s provisions is subject to a civil penalty of:

• No greater than $2,500 for a violation or series of violations concerning a specific consumer; and
• No greater than $100,000 in the aggregate for related violations concerning more than one consumer, unless
  • The violations concern:
    • 10,000 or more consumers who are residents of Utah; and
    • 10,000 or more consumers who are residents of other states; or
  • The person agrees to settle for a greater amount.

An administrative action filed under the Act shall be commenced no later than 10 years after the day on which the alleged breach of system security last occurred. A civil action under the Act shall be commenced no later than five (5) years after the day on which the alleged breach of system security last occurred.

Associated Regulations:

N/A