Utah § 63A-19-401 Duties of governmental entities.

Utah Statutes

§ 63A-19-401 — Duties of governmental entities.

Utah § 63A-19-401

Title 63AUtah Government Operations Code

Ch. 63A-19Government Data Privacy Act

Part 63A-19-4Duties of Governmental Entities

This text of Utah § 63A-19-401 (Duties of governmental entities.) is published on Counsel Stack Legal Research, covering Utah primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Utah Code Ann. § 63A-19-401 (2026).

Text

(1)(1)(a) Except as provided in Subsections (1)(b) and (c), a governmental entity shall comply with the requirements of this part.

(1)(b) If any provision in this part conflicts with any other provisions of law, the more specific or more restrictive law shall control.

(1)(c) A governmental entity that is exempt under Section 63G-2-702, 63G-2-703, or 63G-2-704 from complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records, is exempt from complying with the requirements in this chapter.

(2)(2)(a) A governmental entity shall:

(2)(a)(i) initiate a data privacy program before December 31, 2025;

(2)(a)(ii) obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose;

(2)(a)(i

Free access — add to your briefcase to read the full text and ask questions with AI

(1) (1)(a) Except as provided in Subsections (1)(b) and (c), a governmental entity shall comply with the requirements of this part.
(1)(b) If any provision in this part conflicts with any other provisions of law, the more specific or more restrictive law shall control.
(1)(c) A governmental entity that is exempt under Section 63G-2-702, 63G-2-703, or 63G-2-704 from complying with the requirements in Title 63G, Chapter 2, Part 6, Collection of Information and Accuracy of Records, is exempt from complying with the requirements in this chapter.
(2) (2)(a) A governmental entity shall:
(2)(a)(i) initiate a data privacy program before December 31, 2025;
(2)(a)(ii) obtain and process only the minimum amount of personal data reasonably necessary to efficiently achieve a specified purpose;
(2)(a)(iii) meet the requirements of this part for all new processing activities implemented by a governmental entity; and
(2)(a)(iv) for any processing activity implemented before May 7, 2025, as soon as is reasonably practicable, but no later than July 1, 2027:
(2)(a)(iv)(A) identify any non-compliant processing activity;
(2)(a)(iv)(B) document the non-compliant processing activity;
(2)(a)(iv)(C) prepare a strategy for bringing the non-compliant processing activity into compliance with this part; and
(2)(a)(iv)(D) include the information described in Subsections (2)(a)(iv)(A) through (C) in the privacy program report described in Section 63A-19-401.3.
(2)(b) A governmental entity that fulfills the reporting requirement under Section 63A-19-401.3 satisfies the requirement to initiate a privacy program under Subsection (2)(a)(i).
(3) A governmental entity may not:
(3)(a) establish, maintain, or use undisclosed or covert surveillance of individuals unless permitted by law;
(3)(b) sell personal data unless expressly required by law; and
(3)(c) share personal data unless permitted by law.