Law / United States / 
Utah
Utah Consumer Privacy Act
In force since .
A comprehensive regime rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting, Data subject residence
- Audit expectation
- none
What it requires
- Provide Utah consumers a reasonably accessible, clear privacy notice describing the categories of personal data you process, the purposes, how consumers may exercise their rights, and any third parties you share data with, if you meet UCPA's 25 million dollar revenue and consumer-volume thresholds.NIST Privacy FrameworkCM.AW-P1
- Let Utah consumers opt out of the sale of their personal data and of processing for targeted advertising.NIST Privacy FrameworkCT.PO-P3
- Respond to a Utah consumer's request to access, delete, correct, or receive a portable copy of their personal data within 45 days, or notify the consumer of a single 45-day extension and the reason for it, and do not charge a fee for a consumer's first request in a 12-month period.NIST Privacy FrameworkCT.PO-P3
- Establish reasonable administrative, technical, and physical security practices for personal data, and enter into a written contract with any processor before it processes personal data on your behalf.NIST Privacy FrameworkPR.DS-P5NIST Privacy FrameworkID.DE-P3
These lines are LexLint's reading of the law's text. Also read by: Utah Department of Commerce, Division of Consumer Protection (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P3Contracts with data processing ecosystem parties are used to implement appropriate measures designed to meet the objectives of an organization’s privacy program.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.DS-P5Protections against data leaks are implemented.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://commerce.utah.gov/dcp/ucpa/
- Guidance body
- Utah Department of Commerce, Division of Consumer Protection
- Open questions
- Does the "annual revenue of $25,000,000 or more" test in section 13-61-102(1)(b) count a controller's or processor's worldwide revenue or only revenue earned in Utah?
What it makes you log
What the log must hold
Decision basis
Logging duty
A controller that charges a fee for, or refuses to act on, a consumer's request as excessive, repetitive, technically infeasible, manifestly unfounded, made for another purpose or harassing must be able to demonstrate that the request met one of those criteria, and a controller that processes under an exemption must be able to demonstrate that the processing qualifies. Neither can be shown without a record of the grounds. A controller that declines to act must also tell the consumer its reasons within 45 days (13-61-203(3)), which is a notice. The text names no field of the record beyond the grounds, sets no retention period and sets no audit. Section 13-61-401 lets the Division of Consumer Protection investigate a complaint and section 13-61-402 lets the Attorney General sue after a 30-day cure period, and neither names a power to demand records. The Motor Vehicle Data Privacy part, 13-61-501 to 13-61-504, is read on its own row. The territorial hook is the applicability section, which reaches a controller or processor that conducts business in the state or produces a product or service targeted to consumers who are residents of the state, and the definition of consumer as an individual who is a resident of the state.
- Kind
- Implicit
- As of
- Provision
- Utah Code 13-61-203(4)(b)(ii) (a controller that charges a fee for or refuses a consumer's request bears the burden of demonstrating that the request met a stated criterion) and 13-61-304(4) (a controller that processes personal data under an exemption bears the burden of demonstrating that the processing qualifies)
- Trigger
- consent_or_optout
- personal_data_processing
What this law does
Utah's omnibus consumer-data-privacy statute, enacted as S.B. 227 (Chapter 462, 2022 General Session). Applies only to a controller or processor doing business in or targeting Utah consumers with 25 million dollars or more in annual revenue and either 100,000 or more consumers processed a year, or 25,000 or more consumers processed while deriving over half of revenue from data sales.
Exempts government entities and their contractors, tribes, higher-education institutions, nonprofits, Health Insurance Portability and Accountability Act (HIPAA)-covered entities, and several other sectoral categories. Gives consumers access, deletion, correction, portability, and opt-out rights exercisable against the controller within 45 days, extendable once by 45 more days. The Attorney General has exclusive enforcement authority with a mandatory 30-day cure period, and the Act bars any private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .