Processes personal data, in Utah

Utah Code 13-60-205 · Read the law's page

• If you are an insurer offering health care insurance, do not, in connection with the offer or renewal of an insurance product or in the determination of premiums, coverage, renewal, cancellation, or any other underwriting decision that pertains directly to the individual or to a group the individual belongs to that purchases insurance jointly, access or otherwise take into consideration private genetic information about an asymptomatic individual (Utah Code 13-60-205(1)(a)).
• Do not request or require an asymptomatic individual to consent to a release for the purpose of accessing private genetic information about the individual (Utah Code 13-60-205(1)(b)).
• Do not request or require an asymptomatic individual or the individual's blood relative to submit to a genetic test, or inquire into or otherwise take into consideration the fact that an asymptomatic individual or the individual's blood relative has taken or refused to take a genetic test (Utah Code 13-60-205(1)(c) and (d)).
• Do not request or require an individual or the individual's blood relative to submit to a genetic procedure, or inquire into the results of a genetic procedure that an individual or the individual's blood relative undergoes (Utah Code 13-60-205(1)(e) and (f)).
• Store information you obtain under Subsection (2) only in accordance with the Health Insurance Portability and Accountability Act of 1996, and use or disclose it only in connection with a proceeding to determine your obligation to pay for a genetic test or health care services, making a reasonable effort to limit disclosure to the minimum necessary (Utah Code 13-60-205(2)(d) and (e)).

Utah Code 13-37-101 to 13-37-203 · Read the law's page

• If you are a commercial entity (a person with a physical office in Utah that transacts business there with Utah consumers) and you enter into a consumer transaction, obtain nonpublic personal information from the person as a result, and intend to or want the ability to disclose it to a third party for compensation that is the primary consideration for the disclosure, give the person the notice Utah Code 13-37-201 prescribes (Utah Code 13-37-201(1)).
• Give the notice before the earlier of the point at which you request the information or otherwise obtain it, in the words "We may choose to disclose nonpublic personal information about you, the consumer, to a third party for compensation.", orally only if the whole transaction is oral and otherwise in dark bold, and conspicuously enough that a reasonable person would perceive it before providing the information (Utah Code 13-37-201(2) and (3)).
• Do not disclose nonpublic personal information you obtained on or after January 1, 2004 as a result of a consumer transaction if you failed to give the notice (Utah Code 13-37-202(1)).

Utah Code 13-44-201 · Read the law's page

• This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
• Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.
• Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.
• There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.

Utah Code 13-60-102(3) and 13-60-102(7)(c) · Read the law's page

• To treat data as deidentified under the Genetic Information Privacy Act, take administrative and technical measures to ensure the data cannot be associated with a particular consumer (Utah Code 13-60-102(3)(b)(i)).
• Publicly commit to maintain and use the data in deidentified form and not attempt to reidentify it (Utah Code 13-60-102(3)(b)(ii)).
• Enter into a legally enforceable contract that prohibits any recipient of the data from attempting to reidentify it (Utah Code 13-60-102(3)(b)(iii)).

Utah Code 78B-4-701 to 78B-4-704 · Read the law's page

• This is a defense available to any person sued in Utah on a claim arising from a breach of system security; it creates no independent duty to adopt a cybersecurity program, and under section 78B-4-704 may not be construed to create a private cause of action, including a class action, for failing to comply with it.
• To claim the defense against a claim of failing to implement reasonable information security controls, failing to appropriately respond to a breach, or failing to appropriately notify an affected individual, have in place at the time of the breach a written cybersecurity program designed to protect the type of personal information at issue and scaled to your size, complexity, activities, and the sensitivity of the information you hold.
• Build the program as a reasonable security program, a designated coordinator, procedures to detect, prevent and respond to a breach, employee training, and periodic risk assessments of network and software design, information handling, and data storage and disposal, adjusted as circumstances change, or have it reasonably conform to a current named framework: NIST SP 800-171; NIST SP 800-53 and 800-53A; the FedRAMP Security Assessment Framework; the CIS Critical Security Controls; the ISO/IEC 27000 family; the HIPAA Security Rule or Gramm-Leach-Bliley Title V regulations for information those regimes cover; or the PCI Data Security Standard for payment card information.
• Update the program to a revised framework within one year of the revision's publication, and to an amended regulation within a reasonable time weighed against the risk to personal information and the cost and effort of compliance.
• The defense is unavailable if you had actual notice of a threat or hazard to the information's security and did not act in a reasonable amount of time to take known remedial efforts before it resulted in the breach; a risk assessment to improve security is not itself actual notice.

Utah Code 13-60-101 et seq. · Read the law's page

• Obtain a Utah consumer's initial express consent before collecting, using, or disclosing their genetic data through a direct-to-consumer genetic testing product or service, and give them a public privacy notice describing your data practices.
• Obtain separate express consent before transferring genetic data outside your vendors, using it beyond the primary testing purpose, or retaining a biological sample after testing.
• Let a Utah consumer access their genetic data, delete their account and genetic data, and have their biological sample destroyed on request.
• Do not disclose a Utah consumer's genetic data to a health, life, or long-term-care insurer, or to the consumer's employer, without the consumer's written consent.

Utah Code 13-61-101 et seq. · Read the law's page

• Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.
• Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.
• Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.
• Establish reasonable administrative, technical, and physical security practices for personal data, and enter into a written contract with any processor before it processes personal data on your behalf.

Utah Code 13-61-101(14) and 13-61-101(24)(b) · Read the law's page

• To treat data as deidentified under the Utah Consumer Privacy Act, take reasonable measures to ensure that a person cannot associate the data with an individual (Utah Code 13-61-101(14)(a)(ii)(A)).
• Publicly commit to maintain and use the data only in deidentified form and not to attempt to reidentify it (Utah Code 13-61-101(14)(a)(ii)(B)).
• Contractually obligate any recipient of the data to comply with those two requirements (Utah Code 13-61-101(14)(a)(ii)(C)).

Utah Code 13-61-303 · Read the law's page

• When you use pseudonymous data or deidentified data, take reasonable steps to comply with any contractual obligations the data are subject to, and promptly address any breach of such an obligation (Utah Code 13-61-303(3)).

Utah Code 13-44-101 et seq. · Read the law's page

• If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.
• Notify the Utah Attorney General and the Utah Cyber Center if the breach affects 500 or more Utah residents, and notify nationwide consumer reporting agencies if it affects 1,000 or more.

Utah Code 63A-19-401.4 · Read the law's page

• If you are a contractor that processes or has access to personal data under a contract with a Utah governmental entity, including through your employees, agents or subcontractors, comply with the Government Data Privacy Act for that personal data to the same extent as the governmental entity.
• Accept contract language, in any contract you enter into or renew with a governmental entity after July 1, 2027, requiring you to comply with the Act for the personal data you process or access under it.
• You are not subject to the Act's data privacy training program requirements.
• These requirements are in addition to any other requirement or liability for violating other laws protecting privacy rights or government records.

Utah Health Data Authority, Utah Code 26B-8-507 to 26B-8-509 · Read the law's page

• Do not attempt to identify or re-identify an individual using data obtained under the Utah Health Data Authority part, including through data linking or correlation, except as sections 26B-8-506 and 26B-8-508 allow (Utah Code 26B-8-507(1)(c)).
• If you are the department, use, release or publish information received under the Utah Health Data Authority part only in a way that identifies no person, except as sections 26B-8-506 and 26B-8-508 provide (Utah Code 26B-8-507(1)(b)).
• To obtain identifiable health data from the department, make the request for a specified period or solely for bona fide research or statistical purposes, demonstrate that the data is required for those purposes, and enter into a written agreement satisfactory to the department to protect the data (Utah Code 26B-8-508(4)).
• Once you hold identifiable health data under section 26B-8-508, do not disclose it further without the department's prior approval, and then only by control number, and delete it at the earlier of the end of the specified period or the day your need for it ceases (Utah Code 26B-8-508(5)).

Utah Code 13-61-501 to 13-61-504 · Read the law's page

• The in-vehicle privacy controls duty applies to a motor vehicle with a model year 2030 or later.
• As a motor vehicle manufacturer selling or leasing vehicles in Utah, once in effect, provide in-vehicle privacy controls letting a consumer view what personal data categories the vehicle collects and shares, opt out of sale or targeted-advertising processing, and delete readily accessible data stored locally on the vehicle.

Utah Code 26B-2-250 (enrolled as 26B-2-244 in HB 182, 2026 General Session) · Read the law's page

• Beginning 1 January 2028, if you operate a medical facility or genomic research facility, do not store Utah genetic-sequencing data within the territory of a designated foreign adversary, and do not use a genetic sequencer or sequencing software that is a final product of a foreign adversary.