§ 63A-19-102 — State data privacy policy.

It is the policy of Utah that:
(1) an individual has a fundamental interest in and inherent expectation of privacy regarding the individual's personal data that the individual provides to a governmental entity;
(2) a governmental entity shall process personal data in a manner that is consistent with the interests and expectations described in Subsection (1);
(3) the state shall encourage innovation to enhance the ability of a governmental entity to:
(3)(a) protect the privacy of an individual's personal data;
(3)(b) provide clear notice to an individual regarding the governmental entity's processing of the individual's personal data;
(3)(c) process personal data only for specified, lawful purposes and only process the minimum amount of an individual's personal data necessary to achieve those purposes;
(3)(d) implement appropriate consent mechanisms regarding the uses of an individual's personal data;
(3)(e) provide an individual with the ability to access, control, and request corrections to the individual's personal data held by a governmental entity;
(3)(f) maintain appropriate safeguards to protect the confidentiality, integrity, and availability of personal data;
(3)(g) account for compliance with privacy related laws, rules, and regulations that are specific to a particular governmental entity, program, or personal data; and
(3)(h) meet a governmental entity's and an individual's business and service needs;
(4) the state shall promote training and education programs for employees of governmental entities focused on:
(4)(a) data privacy best practices, obligations, and responsibilities; and
(4)(b) the overlapping relationship with privacy, records management, and security; and
(5) the state shall promote consistent terminology in data privacy requirements across governmental entities.

Legislative History

Amended by Chapter 475, 2025 General Session