Law / United States / 
Utah
Government Data Privacy Act, requirements for contractors of governmental entities
In force since .
A comprehensive regime rule binding public and private bodies.
- Obligation class
- Governance, Contract terms
As of .
What it requires
- If you are a contractor that processes or has access to personal data under a contract with a Utah governmental entity, including through your employees, agents or subcontractors, comply with the Government Data Privacy Act for that personal data to the same extent as the governmental entity.
- Accept contract language, in any contract you enter into or renew with a governmental entity after , requiring you to comply with the Act for the personal data you process or access under it.
- You are not subject to the Act's data privacy training program requirements.
- These requirements are in addition to any other requirement or liability for violating other laws protecting privacy rights or government records.
These lines are LexLint's reading of the law's text, as of .
What this law does
House Bill 444 of the 2025 General Session enacted section 401.4, and the Governor signed it on . A contractor that processes or has access to personal data as a part of its duties under a contract with a governmental entity is subject to the requirements of the Government Data Privacy Act to the same extent as the governmental entity, for that personal data.
A contractor is a person who has entered into a contract with a governmental entity and may process personal data under it, and includes the contractor's employees, agents and subcontractors. A contract entered into or renewed between a contractor and a governmental entity after must contain specific language requiring the contractor to comply with the chapter for the personal data it processes or accesses, to the same extent as the governmental entity.
A contractor is not subject to the data privacy training program requirements of section 401.2. These requirements are in addition to any other requirements or liability for the contractor's violation of other laws protecting privacy rights or government records.
When LexLint raises it
When your app profile says your app processes personal data.