Privacy Map

Utah. Breach notification. Act

UT breach lawUtah data breach notification law (Utah Code §§ 13-44-101 et seq. (Protection of Personal Information Act))

In force

§1Summary

Synopsis

Requires businesses (and in most cases public bodies) that own or license computerised personal information about Utah residents to notify affected individuals after a security breach. Core timing rule: Individuals in the most expedient time possible. Covered data: name plus SSN, driver's licence/ID, financial account with codes.

Key themes
  • breach notification
  • personal information definition
  • regulator notice
  • consumer reporting agency notice
  • vendor-to-owner notice
  • encryption safe harbour
  • substitute notice
  • law enforcement delay
Unique features

Dual notice to AG and the Utah Cyber Center with prescribed content; Utah Cybersecurity Affirmative Defense Act gives a defence for entities with recognised frameworks.

SaaS relevance

A SaaS provider hosting customer data is usually the 'maintaining' entity, not the owner: Utah requires the maintaining entity to notify and cooperate with the owner immediately after discovery if misuse is likely. The owner customer then carries the individual and regulator notices, so contracts should fix timelines and cooperation.

§2Obligations

Extraterritorial
Limited
Breach notification
Individuals in the most expedient time possible; AG and Utah Cyber Center if >=500 residents; CRAs if >=1,000
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $2,500 per consumer; $100,000 aggregate cap (cap lifted for large multistate breaches)

§3Dates

Key dates
  • Adopted
  • In force
  • SB 98 (2024, eff. 2024-05-01) added notice to AG and Utah Cyber Center; 2019 amendments

§4Text and authority

Text
Authority
Utah Attorney General and Utah Cyber Center

§5Where it applies

Domestic law of
Utah

§6Sources and verification

Sources consulted
Verification

High confidence.