Law / United States / 
Utah
Protection of Personal Information Act
In force since .
A breach notification rule binding public and private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Data subject residence
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.NIST Privacy FrameworkCM.AW-P7NIST Privacy FrameworkPR.PO-P7
- Notify the Utah Attorney General and the Utah Cyber Center if the breach affects 500 or more Utah residents, and notify nationwide consumer reporting agencies if it affects 1,000 or more.NIST Privacy FrameworkCM.AW-P7
These lines are LexLint's reading of the law's text. Also read by: Office of the Utah Attorney General (guidance, recorded ).
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://attorneygeneral.utah.gov/data-privacy-2/
- Guidance body
- Office of the Utah Attorney General
- Open questions
- When a breach exposes the personal information of 500 or more Utah residents but the investigation finds misuse likely for only some of them, which count decides whether section 13-44-202(1)(c) requires notice to the Attorney General and the Utah Cyber Center?
What it makes you log
Who may demand the log
Regulator
Logging duty
The Act requires reasonable procedures to prevent unlawful use or disclosure of personal information and to destroy records containing it (13-44-201), and requires a person who owns or licenses computerized data to investigate a breach of system security and notify affected Utah residents and, above stated counts, the Attorney General, the Utah Cyber Center and consumer reporting agencies (13-44-202). The notice to the Attorney General must state the dates, the number of people affected, the type of information and a short description, which is a report and not a record kept. The Act imposes no duty to document breaches or to keep a log. Section 13-44-301(6) and (10) let the Attorney General subpoena records and inspect and copy all records related to the business, a power to demand records with no record named, so the audit key records an on-request check by the regulator. Breach notice in 13-44-202 reaches data concerning a Utah resident, and 13-44-201 reaches a person who conducts business in the state.
- Kind
- None
- As of
What this law does
Requires a person, a term Utah's general Title 68 definitions make broad enough to include a governmental subdivision or agency as well as a private business, who conducts business in Utah and maintains a resident's personal information (a name combined with an unencrypted Social Security number, driver license or state ID number, or financial account or card number with its access code) to implement reasonable procedures against unlawful use or disclosure and to destroy records no longer needed.
On a breach, the person must investigate in good faith and notify each affected Utah resident without unreasonable delay; a breach affecting 500 or more residents also triggers notice to the Attorney General and the Utah Cyber Center, added by a 2024 amendment, and one affecting 1,000 or more also triggers notice to nationwide consumer reporting agencies. Only a financial institution or its affiliate is exempt; unlike UCPA, no governmental-entity exemption appears anywhere in this chapter.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .