Utah Cybersecurity Laws You Should Know (2026)
Last Updated: August 28, 2026
Utah cybersecurity laws require businesses to protect personal information, notify consumers after qualifying data breaches, and comply with one of the country’s comprehensive state privacy laws.
The Utah Consumer Privacy Act (UCPA) gives Utah residents rights involving access, deletion, portability, correction, targeted advertising, and the sale of personal information. Utah also maintains a separate data breach notification law that requires organizations to investigate security incidents and notify affected residents when misuse of personal information has occurred or is reasonably likely to occur.
Whether your organization operates in Utah or collects personal information belonging to Utah residents, understanding these requirements can help reduce regulatory risk while strengthening your overall cybersecurity program.
This guide explains the major Utah cybersecurity laws businesses should understand in 2026.
Utah Cybersecurity Laws at a Glance
| Requirement | Summary |
| Primary Privacy Law | Utah Consumer Privacy Act, Utah Code Title 13, Chapter 61 |
| Privacy Law Effective Date | December 31, 2023 |
| Primary Breach Law | Protection of Personal Information Act, Utah Code Title 13, Chapter 44 |
| Primary Privacy Regulators | Utah Attorney General and Division of Consumer Protection |
| Consumer Request Deadline | Generally 45 days |
| Consumer Privacy Rights | Access, deletion, portability, correction, opt-out of sale and targeted advertising |
| General Breach Notification | Most expedient time possible and without unreasonable delay |
| Sensitive Data | Notice and opportunity to opt out required in certain circumstances |
Utah Cybersecurity Law Timeline
| Year | Legislative Update |
| 2006 | Utah established data breach notification requirements under Title 13, Chapter 44. |
| 2022 | Utah enacted the Utah Consumer Privacy Act. |
| December 31, 2023 | The UCPA became effective. |
| 2024 | Utah updated portions of its breach notification framework and regulatory reporting requirements. |
| 2025 | Utah amended the UCPA to add a consumer right to correct inaccurate personal data. |
| July 1, 2026 | The new correction right became effective. |
| 2026 | Utah continues enforcing both the UCPA and its separate breach notification requirements. |
The current Utah Consumer Privacy Act can be found in Utah Code Title 13, Chapter 61.
Who Should Read This Guide?
This guide is particularly useful for:
- Technology companies
- SaaS providers
- Healthcare organizations
- Manufacturers
- Construction companies
- Financial institutions
- Professional service firms
- E-commerce businesses
- Retailers
- Government contractors
- Any organization collecting personal information from Utah residents
Because the UCPA can apply to organizations headquartered outside Utah, businesses should evaluate whether their activities meet the law’s thresholds even if they do not maintain a physical Utah office.
What Makes Utah Cybersecurity Laws Different?
Utah’s privacy framework is generally considered more business-friendly than laws such as California’s CCPA or Oregon’s Consumer Privacy Act.
The UCPA provides meaningful consumer rights, but it applies to a narrower group of companies and contains fewer obligations than some other comprehensive state privacy laws.
Utah’s framework generally focuses on:
- Consumer access to personal data
- Deletion of certain data
- Data portability
- Correction of inaccurate data
- Opt-out rights involving targeted advertising
- Opt-out rights involving data sales
- Protection of personal information
- Privacy notices
- Data breach response
Organizations should evaluate the privacy law and breach law separately because qualifying under one does not necessarily mean every provision of the other applies.
Utah Consumer Privacy Act
The Utah Consumer Privacy Act, or UCPA, is codified in Utah Code Title 13, Chapter 61.
Official statute: Utah Consumer Privacy Act
The UCPA became effective on December 31, 2023. Utah’s Attorney General explains that the law gives consumers greater control over their personal data while requiring covered businesses to protect information and provide clear privacy disclosures.
Unlike a traditional cybersecurity statute that becomes relevant mainly after an incident, the UCPA regulates personal information throughout its lifecycle.
This can include:
- Collection
- Processing
- Storage
- Disclosure
- Sale
- Targeted advertising
- Consumer requests
- Sensitive data
Which Businesses Must Comply With the UCPA?
The UCPA generally applies to controllers or processors that:
- Conduct business in Utah or produce products or services targeted to Utah residents
- Have annual revenue of at least $25 million
- Meet one of the law’s data-processing thresholds
The business must also generally either:
- Control or process personal data belonging to at least 100,000 consumers during a calendar year, or
- Derive more than 50% of gross revenue from the sale of personal data while controlling or processing information belonging to at least 25,000 consumers
These thresholds make Utah’s privacy law narrower than several other state privacy laws because a business generally must satisfy both the revenue threshold and one of the data thresholds.
Certain entities and types of data are exempt, including some organizations regulated by federal privacy laws.
Businesses should review the statute carefully rather than assuming another regulatory framework automatically exempts the entire organization.
Consumer Rights Under the Utah Consumer Privacy Act
Utah consumers receive several important rights concerning their personal information.
Consumers generally have the right to:
- Confirm whether a controller is processing their personal data
- Access personal data
- Delete personal data they provided to the controller
- Obtain a portable copy of personal data they previously provided
- Correct inaccurate personal data
- Opt out of targeted advertising
- Opt out of the sale of personal data
The right to correct inaccurate personal data became effective July 1, 2026, making it one of the most important recent changes to Utah privacy law.
Covered businesses should ensure their consumer request systems now support correction requests in addition to access, deletion, portability, and opt-out requests.
Consumer Request Deadlines
Businesses generally have 45 days to respond to qualifying privacy requests.
The response period may be extended by an additional 45 days when reasonably necessary because of the complexity or number of requests, provided the consumer receives notice of the extension.
Utah’s Attorney General specifically identifies the 45-day response period in its guidance for businesses and consumers.
Organizations should establish documented procedures for:
- Authenticating requests
- Locating consumer data
- Coordinating with vendors
- Responding within required timeframes
- Documenting completed requests
Utah Privacy Notice Requirements
Covered controllers must provide consumers with a reasonably accessible and clear privacy notice.
The notice should generally explain:
- Categories of personal data processed
- Purposes for processing
- How consumers may exercise privacy rights
- Categories of personal data shared with third parties
- Categories of third parties receiving personal data
If a controller sells personal data or uses it for targeted advertising, the privacy notice should clearly explain how consumers can opt out.
The Utah Attorney General emphasizes clear and accessible privacy notices as one of the UCPA’s central business requirements.
Sensitive Personal Data
The UCPA also establishes special requirements involving sensitive personal data.
Sensitive information can include data revealing:
- Racial or ethnic origin
- Religious beliefs
- Sexual orientation
- Citizenship or immigration status
- Medical history
- Medical diagnosis
- Genetic information
- Biometric information used for identification
- Precise geolocation
- Information belonging to a known child
Before processing sensitive information, controllers generally must provide consumers with clear notice and an opportunity to opt out.
When the information belongs to a known child, processing must generally comply with the Children’s Online Privacy Protection Act.
Organizations should classify sensitive data separately from ordinary business information and maintain stronger controls where appropriate.
Business Responsibilities Under the UCPA
Businesses subject to the Utah Consumer Privacy Act should establish a privacy governance program addressing both consumer rights and cybersecurity.
Responsibilities generally include:
- Maintaining a clear privacy notice
- Responding to consumer privacy requests
- Providing opt-out mechanisms for targeted advertising
- Providing opt-out mechanisms for certain sales
- Protecting confidentiality and integrity of personal information
- Reducing foreseeable risks of harm
- Managing processor relationships
- Limiting collection to reasonably relevant information
- Providing required notices involving sensitive data
Utah’s Attorney General specifically states that businesses subject to the UCPA must protect the confidentiality and integrity of consumer personal data and reduce foreseeable risks of harm related to processing.
Utah Data Breach Notification Law
Utah’s primary breach notification requirements are found in the Protection of Personal Information Act, Utah Code Title 13, Chapter 44.
Official statute: Utah Protection of Personal Information Act
Businesses that own or license computerized personal information concerning Utah residents must conduct a reasonable and prompt investigation after becoming aware of a security breach.
The purpose of the investigation is to determine whether misuse of personal information for identity theft or fraud has occurred or is reasonably likely to occur.
If misuse has occurred or is reasonably likely, affected Utah residents generally must be notified.
Utah Data Breach Notification Deadline
Utah generally requires consumer notification in the:
Most expedient time possible and without unreasonable delay.
Organizations may take appropriate time to:
- Determine the scope of the breach
- Restore the reasonable integrity of affected systems
- Address legitimate law enforcement needs
Utah does not impose one universal 30-day or 45-day consumer notification deadline.
A documented incident response plan helps organizations quickly determine:
- What systems were compromised
- What personal information was involved
- Whether misuse is likely
- Which Utah residents were affected
- Whether regulatory reporting is required
- Whether federal or contractual obligations also apply
Regulatory Breach Notification
Utah’s breach framework includes regulatory reporting requirements in addition to consumer notice.
The current statute requires qualifying organizations to provide certain information regarding the breach, including information such as:
- Date of the breach
- Date the breach was discovered
- Total number of individuals affected
- Number of Utah residents affected
- Types of personal information involved
- A short description of the breach
The Utah Attorney General has enforcement authority under Title 13, Chapter 44.
Businesses should therefore incorporate Utah-specific regulatory reporting into their incident response procedures rather than relying solely on a generic nationwide checklist.
Third-Party Breaches
A business that maintains computerized personal information it does not own or license generally must notify and cooperate with the owner or licensee after discovering a qualifying breach when misuse has occurred or is reasonably likely.
Cooperation can include sharing information relevant to:
- Scope of the breach
- Systems involved
- Personal information affected
- Investigation findings
- Consumer notification
This makes vendor agreements especially important.
Organizations should establish contractual requirements covering:
- Incident notification deadlines
- Investigation cooperation
- Cybersecurity safeguards
- Breach response costs
- Regulatory reporting
- Cyber insurance
- Secure data deletion
What Information Is Protected?
Utah’s breach statute protects personal information that can create identity theft or fraud risks when compromised.
Protected information generally includes a person’s name combined with sensitive identifying or financial information such as:
- Social Security numbers
- Driver’s license numbers
- State identification numbers
- Financial account information
- Credit card information
- Debit card information
- Security codes
- Access credentials
Organizations should maintain an accurate data inventory so they can quickly determine whether information affected by a cyberattack falls within Utah’s statutory definition.
Utah Government Data Breach Requirements
Utah also maintains separate requirements for breaches involving government entities.
Effective May 6, 2026, Utah updated its governmental data breach notification requirements under Utah Code § 63A-19-406.
Government entities generally must notify affected individuals after:
- Determining the scope of the breach
- Restoring system integrity where necessary
- Without unreasonable delay
Notices generally must describe the breach, identify the individual’s personal data that was or may have been accessed, explain mitigation steps, and provide recommendations for protecting against identity theft or financial loss.
These government-specific requirements are separate from the rules governing ordinary private businesses.
Utah Insurance Privacy and Cybersecurity Requirements
Insurance companies operating in Utah may face additional cybersecurity and privacy obligations.
The Utah Insurance Department maintains rules governing privacy and safeguarding customer information.
Official resource: Utah Insurance Rules
Relevant regulations include:
- R590-206, Privacy of Consumer Financial and Health Information
- R590-216, Standards for Safeguarding Customer Information
The Utah Insurance Department identifies these as current insurance rules.
Insurance organizations should therefore evaluate:
- Written security policies
- Customer information safeguards
- Risk assessments
- Vendor relationships
- Access controls
- Incident response procedures
- Privacy notices
- Employee training
Utah Consumer Privacy Act Enforcement
The Utah Attorney General has exclusive authority to enforce the Utah Consumer Privacy Act.
Consumer complaints are generally handled initially by the Utah Division of Consumer Protection. The Division may investigate a complaint and refer matters to the Attorney General when there is reasonable cause to believe a violation has occurred.
Before bringing an enforcement action, the Attorney General generally must provide the controller or processor with written notice identifying the alleged violation and provide a 30-day opportunity to cure.
If the business corrects the violation during that period and provides the required written statement confirming the violation has been cured and will not recur, the Attorney General generally may not proceed with the enforcement action.
If the organization fails to cure the violation, the Attorney General may seek:
- Actual damages to consumers
- Civil penalties of up to $7,500 per violation
The UCPA does not provide a private right of action, meaning consumers generally cannot bring their own lawsuit solely for a violation of the UCPA.
Utah officials reported in 2025 that enforcement activity had initially been relatively limited, although the Attorney General had begun taking enforcement action. This reinforces the importance of viewing Utah privacy compliance as an active regulatory obligation rather than simply a best practice.
Utah Data Breach Regulatory Reporting Requirements
Utah businesses should pay particular attention to the state’s regulatory breach reporting thresholds.
Under the Utah Protection of Personal Information Act, if an investigation determines that misuse involving 500 or more Utah residents has occurred or is reasonably likely to occur, the organization must notify:
- The Utah Office of the Attorney General
- The Utah Cyber Center
If misuse involves 1,000 or more Utah residents, the organization must also notify nationwide consumer reporting agencies.
These requirements are in addition to notifying affected Utah residents.
The Utah Cyber Center maintains a centralized breach reporting process for non-government organizations. Completing the state’s breach reporting form can satisfy the reporting requirement to both the Attorney General and Utah Cyber Center.
Businesses should build these thresholds directly into their incident response plans.
A response team should be able to quickly determine:
- Number of Utah residents affected
- Likelihood that information will be misused
- Date the incident occurred
- Date the incident was discovered
- Categories of personal information affected
- Whether Attorney General notification is required
- Whether Utah Cyber Center notification is required
- Whether consumer reporting agencies must be notified
- Whether other state or federal reporting requirements apply
Federal Cybersecurity Laws That May Apply in Utah
Utah cybersecurity and privacy laws represent only one layer of an organization’s compliance responsibilities.
Depending on the organization’s industry, customers, contracts, and information systems, federal cybersecurity laws may also apply.
Health Insurance Portability and Accountability Act (HIPAA)
The U.S. Department of Health and Human Services maintains the official federal HIPAA resources.
HIPAA generally requires covered organizations to establish administrative, physical, and technical safeguards for protected health information.
Important cybersecurity considerations include:
- Security risk assessments
- Access controls
- Authentication
- Workforce cybersecurity training
- Audit logging
- Incident response procedures
- Business associate agreements
- Backup and recovery planning
- Security policies and procedures
A Utah healthcare organization experiencing a cybersecurity incident may therefore need to evaluate both federal HIPAA requirements and Utah’s state breach notification requirements.
Gramm-Leach-Bliley Act
Banks, lenders, mortgage companies, investment firms, and other qualifying financial institutions may be subject to the Gramm-Leach-Bliley Act (GLBA) and the FTC Safeguards Rule.
The Federal Trade Commission maintains official guidance explaining GLBA privacy and information security requirements.
Covered financial institutions may need to:
- Develop a written information security program
- Conduct cybersecurity risk assessments
- Implement access controls
- Encrypt customer information where appropriate
- Monitor information systems
- Conduct security testing
- Review third-party service providers
- Train employees
- Maintain incident response procedures
Financial institutions operating in Utah should evaluate both GLBA obligations and applicable state breach notification requirements.
Federal Trade Commission Act
Businesses should ensure that statements made in:
- Privacy policies
- Marketing materials
- Contracts
- Security documentation
- Customer communications
accurately reflect their actual cybersecurity and data-management practices.
A company should not claim, for example, that customer information is encrypted everywhere if significant portions of that information remain unencrypted.
Family Educational Rights and Privacy Act
Utah schools, colleges, universities, and certain education-related organizations may also be subject to the Family Educational Rights and Privacy Act (FERPA).
FERPA governs access to and disclosure of student education records.
Educational organizations should evaluate both privacy requirements and technical safeguards protecting student information.
DFARS and NIST SP 800-171
Utah has a significant aerospace, defense, technology, and advanced manufacturing economy.
Businesses working with the Department of Defense or defense contractors may face cybersecurity obligations through their contracts.
Organizations handling Controlled Unclassified Information (CUI) may need to comply with DFARS cybersecurity requirements and NIST SP 800-171.
These requirements can include:
- Multi-factor authentication
- Access controls
- Configuration management
- Audit logging
- Security assessments
- Incident reporting
- System monitoring
- Controlled access to sensitive information
Federal contractors should review the requirements contained in their individual contracts rather than assuming compliance with Utah state law satisfies federal cybersecurity obligations.
NIST Cybersecurity Framework
Many Utah businesses use the NIST Cybersecurity Framework (CSF 2.0) to organize cybersecurity risk management.
The framework is organized around six core functions:
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
Using a recognized cybersecurity framework can help organizations:
- Identify cybersecurity risks
- Document policies
- Prioritize security investments
- Assign security responsibilities
- Improve incident response
- Evaluate vendor risk
- Establish measurable cybersecurity goals
Utah’s privacy framework requires covered businesses to take reasonable steps to safeguard personal information, making a structured cybersecurity framework useful for demonstrating a mature security program.
Utah Insurance Privacy and Security Requirements
Utah insurance organizations may face additional privacy and information-security requirements.
The Utah Insurance Department currently lists several relevant administrative rules, including:
- R590-206, Privacy of Consumer Financial and Health Information
- R590-216, Standards for Safeguarding Customer Information
These rules have the effect of law and supplement other state and federal requirements that may apply to insurers and insurance-related organizations.
Insurance companies should evaluate:
- Customer information safeguards
- Written security policies
- Risk assessments
- Employee access
- Vendor security
- Privacy notices
- Incident response procedures
- Information retention
- Secure information disposal
Organizations should periodically review current Utah Insurance Department rules because insurance cybersecurity requirements can change independently of the UCPA.
Utah Cybersecurity Compliance Checklist
Organizations collecting or maintaining information belonging to Utah residents should regularly review their privacy and cybersecurity programs.
Consider the following steps:
- Determine whether the Utah Consumer Privacy Act applies.
- Inventory personal information throughout the organization.
- Identify sensitive personal data.
- Review privacy notices.
- Provide mechanisms for consumers to access personal information.
- Provide procedures for deletion requests.
- Provide procedures for data portability requests.
- Add procedures for correction requests effective July 1, 2026.
- Provide mechanisms allowing consumers to opt out of targeted advertising.
- Provide mechanisms allowing consumers to opt out of qualifying data sales.
- Provide appropriate notice before processing sensitive data.
- Maintain processor and vendor agreements.
- Protect the confidentiality and integrity of consumer information.
- Conduct periodic cybersecurity risk assessments.
- Require multi-factor authentication for critical systems.
- Encrypt sensitive information where appropriate.
- Maintain endpoint detection and response.
- Review third-party vendor security.
- Develop and test an incident response plan.
- Prepare procedures for the 500-resident Utah regulatory reporting threshold.
- Prepare procedures for the 1,000-resident consumer reporting agency threshold.
- Train employees on phishing and social engineering.
- Test backup and disaster recovery procedures.
- Review privacy and cybersecurity requirements annually.
The addition of the consumer correction right on July 1, 2026 means businesses subject to the UCPA should specifically review their existing consumer privacy request workflows this year.
Example: A Utah Technology Company Experiences Ransomware
Consider a Salt Lake City technology company that discovers ransomware affecting several servers and its cloud environment.
Attackers obtained administrative credentials through a phishing attack and accessed files containing:
- Customer names and contact information
- Employee Social Security numbers
- Financial information
- Customer account information
- Online login credentials
The investigation concludes that personal information belonging to approximately 1,400 Utah residents was acquired and that misuse is reasonably likely.
The company’s response team would need to determine:
- What systems were compromised?
- What personal information was involved?
- Which Utah residents were affected?
- Is identity theft or fraud reasonably likely?
- When should consumers be notified?
- Does the Attorney General need to be notified?
- Does the Utah Cyber Center need to be notified?
- Must consumer reporting agencies be notified?
- Did third-party vendors contribute to the incident?
- Do federal or contractual notification requirements also apply?
Because the incident involves more than 500 Utah residents, the business would generally need to notify the Utah Attorney General and Utah Cyber Center.
Because it involves more than 1,000 Utah residents, nationwide consumer reporting agencies would generally also need to receive notification.
Utah requires affected consumers to be notified in the most expedient time possible and without unreasonable delay after the required investigation establishes that misuse has occurred or is reasonably likely to occur.
This scenario demonstrates why breach-response thresholds should be incorporated into incident response plans before an actual attack occurs.
Frequently Asked Questions About Utah Cybersecurity Laws
What is Utah’s primary consumer privacy law?
The Utah Consumer Privacy Act, codified in Utah Code Title 13, Chapter 61, establishes Utah’s comprehensive consumer privacy framework.
When did the Utah Consumer Privacy Act take effect?
The UCPA became effective on December 31, 2023.
What changed under the Utah Consumer Privacy Act in 2026?
Beginning July 1, 2026, Utah consumers gained the right to request correction of inaccurate personal information held by covered controllers.
What privacy rights do Utah consumers have?
Covered Utah consumers generally have rights involving:
- Access to personal data
- Deletion of personal data they provided
- Data portability
- Correction of inaccurate personal data
- Opting out of targeted advertising
- Opting out of qualifying sales of personal data
How long do businesses have to respond to UCPA requests?
Businesses generally have 45 days to respond to qualifying consumer requests.
Does every Utah business have to comply with the UCPA?
No.
The law contains both revenue and data-processing thresholds, along with various statutory exemptions.
A covered organization generally must have annual revenue of at least $25 million and also meet one of the law’s qualifying data-processing thresholds.
Does Utah require businesses to protect personal information?
Yes.
Utah requires covered businesses to take reasonable steps to protect the confidentiality and integrity of personal data and reduce foreseeable risks of harm.
How quickly must Utah residents be notified following a breach?
Affected consumers generally must be notified in the most expedient time possible and without unreasonable delay when an investigation determines that misuse for identity theft or fraud has occurred or is reasonably likely.
When must the Utah Attorney General be notified of a breach?
If misuse involving 500 or more Utah residents has occurred or is reasonably likely to occur, the business generally must notify the Utah Attorney General and Utah Cyber Center.
When must consumer reporting agencies be notified?
If misuse involves 1,000 or more Utah residents, nationwide consumer reporting agencies generally must also be notified.
Does the UCPA have a private right of action?
No.
The Utah Attorney General has exclusive authority to enforce the UCPA. Consumers cannot bring lawsuits solely based on a UCPA violation.
How much can a UCPA violation cost?
After the required enforcement process and opportunity to cure, the Attorney General may seek actual consumer damages and civil penalties of up to $7,500 per violation.
Does Utah provide businesses an opportunity to cure privacy violations?
Yes.
The UCPA generally requires the Attorney General to provide written notice and a 30-day opportunity to cure before bringing an enforcement action.
Does ransomware automatically trigger breach notification?
No.
Organizations should first conduct the reasonable and prompt investigation required by Utah law to determine whether protected personal information has been or is reasonably likely to be misused for identity theft or fraud.
Does complying with Utah law satisfy federal cybersecurity requirements?
No.
Utah businesses may also need to comply with HIPAA, GLBA, FERPA, FTC requirements, DFARS, NIST SP 800-171, PCI DSS, contractual requirements, or other industry-specific cybersecurity standards.
Organizations operating across state lines should review each jurisdiction individually because consumer rights, applicability thresholds, breach definitions, regulator reporting requirements, and notification deadlines vary significantly.
Related Cybersecurity Guides
Continue learning about cybersecurity compliance by exploring:
- Nevada Cybersecurity Laws
- Idaho Cybersecurity Laws
- Colorado Cybersecurity Laws
- Arizona Cybersecurity Laws
- Wyoming Cybersecurity Laws
Conclusion
Utah has developed a cybersecurity and privacy framework combining the Utah Consumer Privacy Act with the state’s Protection of Personal Information Act and additional industry-specific requirements.
The privacy environment continued to evolve in 2026. Beginning July 1, Utah consumers gained a new right to correct inaccurate personal data, adding another obligation to the consumer-request processes maintained by businesses subject to the UCPA.
Organizations should also understand Utah’s specific breach reporting thresholds. Incidents involving likely misuse of personal information belonging to at least 500 Utah residents generally require notification to the Utah Attorney General and Utah Cyber Center, while incidents involving 1,000 or more residents also trigger notification to nationwide consumer reporting agencies.
Businesses should treat compliance as an ongoing governance responsibility. Privacy notices, data inventories, consumer request procedures, cybersecurity risk assessments, vendor management, employee security awareness, incident response procedures, and technical safeguards should all be reviewed regularly.
Organizations that proactively strengthen these areas are better positioned to protect sensitive information, respond effectively to security incidents, comply with Utah’s evolving privacy requirements, and maintain trust with customers.
Disclaimer: This article is provided for informational purposes only and does not constitute legal advice. Organizations should consult qualified legal counsel regarding the application of Utah cybersecurity and privacy laws to their specific circumstances.
