Law / United States / 
Utah
Government Data Privacy Act, data breach notice to affected individuals
In force since .
A breach notification rule binding government bodies.
- Obligation class
- Breach notice
As of .
What it requires
- This section binds a governmental entity and its contractor; the notice to the Utah Cyber Center and the Attorney General under section 63A-19-405 is a separate duty.
- After determining the scope of a data breach and restoring the reasonable integrity of the affected system, cause a data breach notice to be sent without unreasonable delay to each affected individual or legal guardian, unless the personal data involved is a public record and you prominently post notice of the breach on the homepage of your government website.
- Include in the notice a description of the data breach, the individual's personal data that was or may have been accessed, the steps taken to mitigate the impact, and recommendations on protecting against identity theft and other financial losses.
- Send the notice by email, if reasonably available and allowed by law, or by mail, and also by text message or telephone message with a summary and instructions for the full notice where contact information is reasonably available and the method is allowed by law.
- Delay the notice, whether you are the governmental entity or its contractor, at the request of a law enforcement agency that determines notification may impede a criminal investigation, until it says notification will no longer impede the investigation.
- If a breach affects more than 500 individuals and you cannot obtain an individual's contact information, also give notice in a manner reasonably calculated to reach the individual, such as a press release, a social media posting or a newspaper notice.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
The State Auditor investigates alleged violations on the instruction of the Utah Privacy Governing Board and gives the entity 30 days to cure; the Attorney General may sue to enjoin or compel compliance by an entity that is not a state agency, and an uncured violation by a state agency is reported to the Legislative Management Committee.
What this law does
Section 406 first took effect on . After determining the scope of a data breach, and restoring the reasonable integrity of the affected system if necessary, a governmental entity must cause a data breach notice to be sent without unreasonable delay to each affected individual or legal guardian.
No notice to an affected individual is required if the personal data involved would be a public record and the entity prominently posts notice of the data breach on the homepage of its government website. The entity or its contractor must delay notice at the request of a law enforcement agency that determines notification may impede a criminal investigation.
The notice must include a description of the data breach, the individual's personal data that was or may have been accessed, the steps taken to mitigate the impact, and recommendations on protecting against identity theft and other financial losses.
Notice must go by email, if reasonably available and allowed by law, or by mail, and also by text message or telephone message with a summary and instructions for the full notice where the individual's contact information is reasonably available and the method is allowed by law.
If a breach affects more than 500 individuals and the entity cannot obtain an individual's contact information, it must also give notice in a manner reasonably calculated to reach the individual, such as a press release, social media posting or newspaper notice.
When LexLint raises it
When your app profile says your app processes personal data.