Protection of Personal Information Act

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 May 2024.

A breach notification rule binding public and private bodies.

As of 23 August 2026.

What it requires

If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.
Notify the Utah Attorney General and the Utah Cyber Center if the breach affects 500 or more Utah residents, and notify nationwide consumer reporting agencies if it affects 1,000 or more.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Requires a person, a term Utah's general Title 68 definitions make broad enough to include a governmental subdivision or agency as well as a private business, who conducts business in Utah and maintains a resident's personal information (a name combined with an unencrypted Social Security number, driver license or state ID number, or financial account or card number with its access code) to implement reasonable procedures against unlawful use or disclosure and to destroy records no longer needed.

On a breach, the person must investigate in good faith and notify each affected Utah resident without unreasonable delay; a breach affecting 500 or more residents also triggers notice to the Attorney General and the Utah Cyber Center, added by a 2024 amendment, and one affecting 1,000 or more also triggers notice to nationwide consumer reporting agencies. Only a financial institution or its affiliate is exempt; unlike UCPA, no governmental-entity exemption appears anywhere in this chapter.

When LexLint raises it

crawls_web
trains_models
automated_outreach
deploys_chatbot

Read the law

official Utah Code text, Utah State Legislature

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app