Law / United States / 
Utah
Protection of Personal Information Act, reasonable procedures and records-destruction duty
In force since .
A security baseline statutes rule binding public and private bodies.
- Private right of action
- No
- Obligation class
- Security
What it requires
- This binds any person who conducts business in Utah and maintains personal information collected or maintained in the regular course of business.
- Implement and maintain reasonable procedures to prevent the unlawful use or disclosure of that personal information. The statute states no further content for what 'reasonable' requires beyond this general standard.NIST CSF 2.0PR.DS-01
- Destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by the method the section specifies.NIST CSF 2.0ID.AM-08
- There is no private right of action for a violation of this section; only the Utah Attorney General may enforce this chapter.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
What this law does
Utah Code 13-44-201, part of the Protection of Personal Information Act, requires any person who conducts business in the state and maintains personal information, reaching a governmental entity conducting business as well as a private business, the same broad reading of 'person' this jurisdiction's privacy-topic row already applies to the Act's breach-notification duty, to implement and maintain reasonable procedures to prevent the unlawful use or disclosure of personal information collected or maintained in the regular course of business, and to destroy, or arrange for the destruction of, records containing personal information that are not to be retained, by a method the section specifies.
The section states no further content for what 'reasonable' requires beyond that general standard, and, like the rest of the chapter, creates no private right of action: only the Attorney General may enforce it. The chapter's own breach-notification duty, requiring notice to an affected Utah resident and, for a large breach, to the Attorney General and the Utah Cyber Center, is this jurisdiction's privacy-topic row rather than repeated here. The section was enacted by Laws of Utah 2006, chapter 343. That chapter took effect on .
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings, processes biometric data, processes personal data, serves under-18s, operates a social platform, ships a mobile app, distributes a software product, generates content with AI, publishes adult content, operates an app store, reuses other publishers' content, records calls, records text chat or tracks devices.
Back to the example · Lint your app
Page updated .