Law / United States / 
Utah
Government Data Privacy Act, notification of a data breach by a governmental entity to the Utah Cyber Center
In force since .
A vulnerability and incident reporting rule binding government bodies.
- Obligation class
- Reporting
As of .
What it requires
- This duty binds a governmental entity, which section 63A-16-1101 ties to the meaning in section 63G-2-103; it does not bind a private business.
- Notify the Utah Cyber Center, and the attorney general where the breach affects 500 or more individuals, of a data breach, without unreasonable delay and no later than five days from discovery, stating the date and time of the breach, the date of discovery, a short description, how access was gained, who perpetrated it, the mitigation steps taken and any other detail the Cyber Center requests.
- If that information is not available within five days, provide what is available and supplement the notification as the information becomes available.
- For a data breach affecting 500 or more individuals, also give the Cyber Center and the attorney general the total number of individuals affected, including the number of Utah residents, and the type of personal data involved.
- For a data breach affecting fewer than 500 individuals, create an internal incident report as soon as practicable, give it to the Cyber Center on request, and give the Cyber Center an annual report logging all such incidents.
These lines are LexLint's reading of the law's text, as of .
What this law does
A governmental entity that identifies a data breach affecting 500 or more individuals must notify the Cyber Center and the attorney general. A governmental entity must also notify the Cyber Center when it identifies unauthorized access, acquisition, disclosure, loss of access or destruction of data that compromises the security, confidentiality, availability or integrity of its computer systems or information.
The notification must be made without unreasonable delay and no later than five days from the discovery of the data breach. A governmental entity with a data breach affecting fewer than 500 individuals must create an internal incident report and give the Cyber Center an annual report logging those incidents. The section was last amended by Chapter 202 of the 2026 General Session.