Law note · Utah
Protection of Personal Information Act
Requires a person, a term Utah's general Title 68 definitions make broad enough to include a governmental subdivision or agency as well as a private business, who conducts business in Utah and maintains a resident's personal information (a name combined with an unencrypted Social Security number, driver license or state ID number, or financial account or card number with its access code) to implement reasonable procedures against unlawful use or disclosure and to destroy records no longer needed.
On a breach, the person must investigate in good faith and notify each affected Utah resident without unreasonable delay; a breach affecting 500 or more residents also triggers notice to the Attorney General and the Utah Cyber Center, added by a 2024 amendment, and one affecting 1,000 or more also triggers notice to nationwide consumer reporting agencies. Only a financial institution or its affiliate is exempt; unlike UCPA, no governmental-entity exemption appears anywhere in this chapter.
What it asks of an app
- If unencrypted Utah-resident data combining a name with a Social Security number, a driver license or state ID number, or a financial account or card number with its access code is breached, investigate promptly in good faith and notify each affected Utah resident without unreasonable delay.
- Notify the Utah Attorney General and the Utah Cyber Center if the breach affects 500 or more Utah residents, and notify nationwide consumer reporting agencies if it affects 1,000 or more.
When LexLint raises it
Declared activities: crawls_web, trains_models, automated_outreach, deploys_chatbot
Primary source: official Utah Code text, Utah State Legislature